Edit tour

Windows Analysis Report
urS3jQ9qb5.jar

Overview

General Information

Sample name:	urS3jQ9qb5.jar renamed because original name is a hash value
Original sample name:	0781770e55d04cd363e0da0b168cb8550db96faf6790fd7a17b216d80b0bff43.jar
Analysis ID:	1577278
MD5:	c61d3cf6584e6b4c19c092f55cd3c37c
SHA1:	80f4680dcbaedb8b981e27b552c458cb8baa3d13
SHA256:	0781770e55d04cd363e0da0b168cb8550db96faf6790fd7a17b216d80b0bff43
Tags:	canstealer-comjaruser-JAMESWT_MHT
Infos:

Detection

Can Stealer

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Yara detected Can Stealer

AI detected suspicious sample

Exploit detected, runtime environment dropped PE file

Exploit detected, runtime environment starts unknown processes

Maps a DLL or memory area into another process

Sigma detected: Potential Data Stealing Via Chromium Headless Debugging

Sigma detected: Suspicious Processes Spawned by Java.EXE

Tries to harvest and steal browser information (history, passwords, etc)

Uses the Telegram API (likely for C&C communication)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Browser Execution In Headless Mode

Sigma detected: Browser Started with Remote Debugging

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

cmd.exe (PID: 5260 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\urS3jQ9qb5.jar"" >> C:\cmdlinestart.log 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

java.exe (PID: 7076 cmdline: "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\urS3jQ9qb5.jar" MD5: 9DAA53BAB2ECB33DC0D9CA51552701FA)

icacls.exe (PID: 2420 cmdline: C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M MD5: 2E49585E4E08565F52090B144062F97E)

conhost.exe (PID: 5176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5008 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

conhost.exe (PID: 5368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1824 cmdline: taskkill /F /IM msedge.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msedge.exe (PID: 5936 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 6432 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=2220 --field-trial-handle=2200,i,14542655992206268435,5345874362756647771,262144 --disable-features=PaintHolding /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

taskkill.exe (PID: 8840 cmdline: taskkill /F /IM msedge.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 8976 cmdline: taskkill /F /IM chrome.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 9036 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory=Default MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 672 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --mojo-platform-channel-handle=2116 --field-trial-handle=2024,i,13611784778153370748,11681789006057499304,262144 --disable-features=PaintHolding /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

taskkill.exe (PID: 7700 cmdline: taskkill /F /IM brave.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 7388 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 7804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 8116 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 8064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 7472 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 7564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 7300 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 7252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 7492 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 7512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 7620 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 7448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 7356 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 8920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 7324 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 7888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 4032 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 4548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 876 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 5320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 3328 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 2828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 7852 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 7856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 3300 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 1492 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 5008 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 5644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 7400 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 7420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HOSTNAME.EXE (PID: 4976 cmdline: hostname MD5: B1C51FED46434CF91E65C7B605F8EF3A)

conhost.exe (PID: 5860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 4368 cmdline: wmic path win32_VideoController get name MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 7292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 5340 cmdline: wmic cpu get name MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 7580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7952 cmdline: wmic os get Caption /value MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 7988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msedge.exe (PID: 4084 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --noerrdialogs --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 1976 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=2160 --field-trial-handle=2052,i,8316993096475149264,6081251299301412000,262144 --disable-features=PaintHolding /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8284 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=6580 --field-trial-handle=2052,i,8316993096475149264,6081251299301412000,262144 --disable-features=PaintHolding /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8320 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=6960 --field-trial-handle=2052,i,8316993096475149264,6081251299301412000,262144 --disable-features=PaintHolding /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8436 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=7076 --field-trial-handle=2052,i,8316993096475149264,6081251299301412000,262144 --disable-features=PaintHolding /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8448 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=7076 --field-trial-handle=2052,i,8316993096475149264,6081251299301412000,262144 --disable-features=PaintHolding /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.2435946154.00000000169E5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CanStealer	Yara detected Can Stealer	Joe Security
00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CanStealer	Yara detected Can Stealer	Joe Security
00000002.00000002.2643684011.00000000169AC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CanStealer	Yara detected Can Stealer	Joe Security
00000002.00000003.2435636231.0000000016987000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CanStealer	Yara detected Can Stealer	Joe Security
Process Memory Space: java.exe PID: 7076	JoeSecurity_CanStealer	Yara detected Can Stealer	Joe Security
Process Memory Space: java.exe PID: 7076	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Potential Data Stealing Via Chromium Headless Debugging

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default, CommandLine: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default, CommandLine|base64offset|contains: )^, Image: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, NewProcessName: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, OriginalFileName: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ParentCommandLine: "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\urS3jQ9qb5.jar" , ParentImage: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe, ParentProcessId: 7076, ParentProcessName: java.exe, ProcessCommandLine: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default, ProcessId: 5936, ProcessName: msedge.exe

Sigma detected: Suspicious Processes Spawned by Java.EXE

Source: Process started

Author: Andreas Hunkeler (@Karneades), Florian Roth: Data: Command: wmic path win32_VideoController get name, CommandLine: wmic path win32_VideoController get name, CommandLine|base64offset|contains: h, Image: C:\Windows\SysWOW64\wbem\WMIC.exe, NewProcessName: C:\Windows\SysWOW64\wbem\WMIC.exe, OriginalFileName: C:\Windows\SysWOW64\wbem\WMIC.exe, ParentCommandLine: "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\urS3jQ9qb5.jar" , ParentImage: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe, ParentProcessId: 7076, ParentProcessName: java.exe, ProcessCommandLine: wmic path win32_VideoController get name, ProcessId: 4368, ProcessName: WMIC.exe

Sigma detected: Browser Execution In Headless Mode

Source: Process started

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default, CommandLine: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default, CommandLine|base64offset|contains: )^, Image: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, NewProcessName: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, OriginalFileName: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ParentCommandLine: "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\urS3jQ9qb5.jar" , ParentImage: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe, ParentProcessId: 7076, ParentProcessName: java.exe, ProcessCommandLine: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default, ProcessId: 5936, ProcessName: msedge.exe

Sigma detected: Suspicious Execution of Hostname

Source: Process started

Author: frack113: Data: Command: hostname, CommandLine: hostname, CommandLine|base64offset|contains: -, Image: C:\Windows\SysWOW64\HOSTNAME.EXE, NewProcessName: C:\Windows\SysWOW64\HOSTNAME.EXE, OriginalFileName: C:\Windows\SysWOW64\HOSTNAME.EXE, ParentCommandLine: "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\urS3jQ9qb5.jar" , ParentImage: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe, ParentProcessId: 7076, ParentProcessName: java.exe, ProcessCommandLine: hostname, ProcessId: 7388, ProcessName: HOSTNAME.EXE

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://canstealer.com/kaancevik63	Avira URL Cloud: Label: malware
Source: https://canstealer.com/	Avira URL Cloud: Label: malware

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.3% probability

Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:50018 version: TLS 1.2

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	File opened: C:\Users\user\AppData\Local\Temp\jna-1820491375\	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	File opened: C:\Users\user\AppData\Local\Temp\jna-1820491375\jna5340335501256029183.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Software Vulnerabilities

Exploit detected, runtime environment starts unknown processes

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Process created: C:\Windows\SysWOW64\tasklist.exe

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 185.199.110.133 185.199.110.133
Source: Joe Sandbox View	IP Address: 185.199.110.133 185.199.110.133

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: api.gofile.io
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: canstealer.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 905sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: java.exe, 00000002.00000002.2638926084.000000000A5F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: java.exe, 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt
Source: java.exe, 00000002.00000002.2638926084.000000000AE6F000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: java.exe, 00000002.00000002.2638926084.000000000AE6F000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt
Source: java.exe, 00000002.00000002.2638926084.000000000AE6F000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: java.exe, 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt3
Source: java.exe, 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: java.exe, 00000002.00000002.2638926084.000000000AE6F000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: java.exe, 00000002.00000003.2434809680.0000000016D81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACer
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: java.exe, 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl
Source: java.exe, 00000002.00000002.2638926084.000000000AE6F000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: java.exe, 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl
Source: java.exe, 00000002.00000002.2638926084.000000000AE6F000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: java.exe, 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl
Source: java.exe, 00000002.00000002.2638926084.000000000AE6F000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: java.exe, 00000002.00000002.2642541893.000000001607F000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2435417835.000000001607F000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2644197266.0000000016DC8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2434809680.0000000016D81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://null.oracle.com/
Source: java.exe, 00000002.00000002.2642541893.000000001607F000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2435417835.000000001607F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://null.oracle.com/B
Source: java.exe, 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com
Source: java.exe, 00000002.00000002.2638926084.000000000AE6F000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: java.exe, 00000002.00000002.2638926084.000000000AE6F000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: java.exe, 00000002.00000002.2638926084.000000000AE6F000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: java.exe, 00000002.00000002.2638926084.000000000AB1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: java.exe, 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/servers
Source: java.exe, 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/serversC3
Source: java.exe, 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/serversKu
Source: java.exe, 00000002.00000002.2617226534.000000000535E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: java.exe, 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000003.2383624447.00000000159A8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: java.exe, 00000002.00000002.2617226534.000000000535E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7771186573:AAHGj8VtumJ9kjTUYRUQm886fmn2UiPGXSk/sendMessage
Source: java.exe, 00000002.00000003.2435946154.00000000169E5000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2435636231.0000000016987000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2643684011.00000000169AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/botss
Source: java.exe, 00000002.00000002.2617226534.000000000500F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canstealer.com/
Source: java.exe, 00000002.00000002.2617226534.000000000546E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://canstealer.com/kaancevik63
Source: java.exe, 00000002.00000003.2383624447.00000000159A8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: java.exe, 00000002.00000003.2435636231.0000000016987000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2643684011.00000000169AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/.ldb
Source: java.exe, 00000002.00000003.2383624447.00000000159A8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2435946154.00000000169E5000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2435636231.0000000016987000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2643684011.00000000169AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/embed/avatars/0.png
Source: java.exe, 00000002.00000003.2435946154.00000000169E5000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2435636231.0000000016987000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2643684011.00000000169AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/embed/avatars/0.pngw
Source: java.exe, 00000002.00000003.2383624447.00000000159A8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2273557661.00000000159D8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2273763754.00000000159E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/TooTallNate/Java-WebSocket/wiki/Lost-connection-detection
Source: java.exe, 00000002.00000002.2641835595.00000000156E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/TooTallNate/Java-WebSocket/wiki/Lost-connection-detection/lang/
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: java.exe, 00000002.00000003.2383624447.00000000159A8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paste-pgpj.onrender.com/?p=
Source: java.exe, 00000002.00000003.2437014648.0000000015F3F000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642541893.0000000015EDB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2435417835.0000000015F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paste-pgpj.onrender.com/?p=ava/l
Source: java.exe, 00000002.00000002.2617226534.0000000005199000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: java.exe, 00000002.00000002.2617226534.0000000005199000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/sonriseclient/kaancevik6-startup-6107/main/Java.jar
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000003.2393293665.000000000B000000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://repository.luxtrust.lu
Source: java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFE7000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000003.2393293665.000000000B000000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://repository.luxtrust.lu0
Source: java.exe, 00000002.00000003.2393293665.000000000B000000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://repository.luxtrust.lu3
Source: java.exe, 00000002.00000003.2274039052.0000000015DB5000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642541893.0000000015CD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html
Source: java.exe, 00000002.00000002.2642541893.0000000015CD0000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#ignoredBindings
Source: java.exe, 00000002.00000002.2642541893.0000000015CD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#loggerNameMismatch
Source: java.exe, 00000002.00000003.2273763754.00000000159E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#multiple_bindings
Source: java.exe, 00000002.00000002.2642541893.0000000015CD0000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A5F3000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A610000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#noProviders
Source: java.exe, 00000002.00000003.2383624447.00000000159A8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#noProvidersionL
Source: java.exe, 00000002.00000002.2642541893.0000000015CD0000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#replay
Source: java.exe, 00000002.00000002.2642541893.0000000015CD0000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2273557661.00000000159D8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2273763754.00000000159E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#substituteLogger
Source: java.exe, 00000002.00000003.2383624447.00000000159A8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2273557661.00000000159D8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2273763754.00000000159E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#substituteLogger/M
Source: java.exe, 00000002.00000002.2642541893.0000000015CD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#unsuccessfulInit
Source: java.exe, 00000002.00000003.2274039052.0000000015DB5000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642541893.0000000015CD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#unsuccessfulInit;
Source: java.exe, 00000002.00000002.2642541893.0000000015CD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#unsuccessfulInitG
Source: java.exe, 00000002.00000002.2642541893.0000000015CD0000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2273557661.00000000159D8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2273763754.00000000159E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.html#version_mismatch
Source: java.exe, 00000002.00000003.2383624447.00000000159A8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2273557661.00000000159D8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2273763754.00000000159E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.slf4j.org/codes.htmlU

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:50018 version: TLS 1.2

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_18B085CF	2_3_18B085CF
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_18B085CF	2_3_18B085CF
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_18B0A749	2_3_18B0A749
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_18B0A749	2_3_18B0A749
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_18B085CF	2_3_18B085CF
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_18B085CF	2_3_18B085CF
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_18B1070D	2_3_18B1070D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_18B0A749	2_3_18B0A749
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_18B0A749	2_3_18B0A749

Source: classification engine

Classification label: mal96.troj.spyw.expl.evad.winJAR@167/111@25/14

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\83aa4cc77f591dfc2374580bbd95f6ba_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7584:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8924:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3700:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7512:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4548:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7988:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7564:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8920:120:WilError_03
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5644:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7580:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7252:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1492:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8984:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8064:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7448:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5544:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5860:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5176:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7804:120:WilError_03

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

File created: C:\Users\user\AppData\Local\Temp\hsperfdata_user

Jump to behavior

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "msedge.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "msedge.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "brave.exe")
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: java.exe, 00000002.00000002.2646914740.0000000065BC4000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: java.exe, 00000002.00000002.2646914740.0000000065BC4000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: java.exe, 00000002.00000002.2646914740.0000000065BC4000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: java.exe, 00000002.00000002.2646914740.0000000065BC4000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: java.exe, 00000002.00000002.2646914740.0000000065BC4000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: java.exe, 00000002.00000002.2646914740.0000000065BC4000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: java.exe, 00000002.00000002.2646914740.0000000065BC4000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: java.exe, 00000002.00000002.2646914740.0000000065BC4000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: java.exe, 00000002.00000002.2646914740.0000000065BC4000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: java.exe, 00000002.00000003.2362980137.0000000017106000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: java.exe	String found in binary or memory: 0$h`[Lsun/launcher/LauncherHelper;
Source: java.exe	String found in binary or memory: Q()[Lsun/launcher/LauncherHelper;'
Source: java.exe	String found in binary or memory: Lsun/launcher/LauncherHelper;
Source: java.exe	String found in binary or memory: JLjava/lang/Enum<Lsun/launcher/LauncherHelper;>;
Source: java.exe	String found in binary or memory: Bsun/launcher/LauncherHelper$ResourceBundleHolder&
Source: java.exe	String found in binary or memory: Hsun/launcher/LauncherHelper$SizePrefix
Source: java.exe	String found in binary or memory: $sun/launcher/LauncherHelper$StdArg
Source: java.exe	String found in binary or memory: hq(Ljava/util/List<Lsun/launcher/LauncherHelper$StdArg;>;)[Ljava/lang/String;
Source: java.exe	String found in binary or memory: (Ljava/lang/String;)Lsun/launcher/LauncherHelper;
Source: java.exe	String found in binary or memory: N.in-addr.arpa
Source: java.exe	String found in binary or memory: sun/launcher/

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\urS3jQ9qb5.jar"" >> C:\cmdlinestart.log 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\urS3jQ9qb5.jar"
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\tasklist.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=2220 --field-trial-handle=2200,i,14542655992206268435,5345874362756647771,262144 --disable-features=PaintHolding /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --noerrdialogs --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=2160 --field-trial-handle=2052,i,8316993096475149264,6081251299301412000,262144 --disable-features=PaintHolding /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=6580 --field-trial-handle=2052,i,8316993096475149264,6081251299301412000,262144 --disable-features=PaintHolding /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=6960 --field-trial-handle=2052,i,8316993096475149264,6081251299301412000,262144 --disable-features=PaintHolding /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=7076 --field-trial-handle=2052,i,8316993096475149264,6081251299301412000,262144 --disable-features=PaintHolding /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=7076 --field-trial-handle=2052,i,8316993096475149264,6081251299301412000,262144 --disable-features=PaintHolding /prefetch:8
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory=Default
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --mojo-platform-channel-handle=2116 --field-trial-handle=2024,i,13611784778153370748,11681789006057499304,262144 --disable-features=PaintHolding /prefetch:8
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get name
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption /value
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\urS3jQ9qb5.jar"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory=Default	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get name	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption /value	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=2220 --field-trial-handle=2200,i,14542655992206268435,5345874362756647771,262144 --disable-features=PaintHolding /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get name	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=2160 --field-trial-handle=2052,i,8316993096475149264,6081251299301412000,262144 --disable-features=PaintHolding /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=6580 --field-trial-handle=2052,i,8316993096475149264,6081251299301412000,262144 --disable-features=PaintHolding /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=6960 --field-trial-handle=2052,i,8316993096475149264,6081251299301412000,262144 --disable-features=PaintHolding /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=7076 --field-trial-handle=2052,i,8316993096475149264,6081251299301412000,262144 --disable-features=PaintHolding /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=7076 --field-trial-handle=2052,i,8316993096475149264,6081251299301412000,262144 --disable-features=PaintHolding /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --mojo-platform-channel-handle=2116 --field-trial-handle=2024,i,13611784778153370748,11681789006057499304,262144 --disable-features=PaintHolding /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: opengl32.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: glu32.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll

Source: C:\Windows\SysWOW64\tasklist.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: urS3jQ9qb5.jar

Static file information: File size 14298253 > 1048576

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_16952096 push ss; ret	2_3_169520A4
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_16952AB7 push ss; retf 0000h	2_3_16952AC4
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_1694EEA4 push ss; ret	2_3_1694EEDC
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_1694CFA2 push ss; iretd	2_3_1694D008
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_1694CEE2 push eax; iretd	2_3_1694CF45
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_1694EF39 push ss; ret	2_3_1694EEDC
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_1694CB2E pushad ; retf	2_3_1694CB3D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_1694CE55 push eax; iretd	2_3_1694CED5
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_15F2C284 pushad ; ret	2_3_15F2C285
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_159ACB58 pushad ; retf	2_3_159ACB59
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_15F1417A push ebx; ret	2_3_15F1417B
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_18B0D105 push 00000010h; ret	2_3_18B0D10C
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_18B0D105 push 00000010h; ret	2_3_18B0D10C
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_18B0D173 push 00000010h; ret	2_3_18B0D188
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_18B0D173 push 00000010h; ret	2_3_18B0D188
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_18B0D105 push 00000010h; ret	2_3_18B0D10C
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_18B0D105 push 00000010h; ret	2_3_18B0D10C
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_18B0D173 push 00000010h; ret	2_3_18B0D188
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_18B0D173 push 00000010h; ret	2_3_18B0D188
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_17C6E10C push dword ptr [eax]; iretd	2_3_17C6E121
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_17C7CB58 pushad ; retf	2_3_17C7CB59
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Code function: 2_3_17C68063 push dword ptr [eax]; iretd	2_3_17C68079

Persistence and Installation Behavior

Exploit detected, runtime environment dropped PE file

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

File created: jna5340335501256029183.dll.2.dr

Jump to dropped file

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	File created: C:\Users\user\AppData\Local\Temp\jna-1820491375\jna5340335501256029183.dll			Jump to dropped file
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	File created: C:\Users\user\AppData\Local\Temp\sqlite-3.20.1-2b1cbfdc-5534-4adc-ad94-dd4ff06aa3aa-sqlitejdbc.dll			Jump to dropped file

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\jna-1820491375\jna5340335501256029183.dll			Jump to dropped file
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\sqlite-3.20.1-2b1cbfdc-5534-4adc-ad94-dd4ff06aa3aa-sqlitejdbc.dll			Jump to dropped file

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	File opened: C:\Users\user\AppData\Local\Temp\jna-1820491375\	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	File opened: C:\Users\user\AppData\Local\Temp\jna-1820491375\jna5340335501256029183.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Source: java.exe, 00000002.00000003.2161647001.0000000015465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000002.00000003.2161647001.0000000015465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000002.00000002.2643684011.00000000168E0000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2436775896.0000000016949000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4qemultByInt&
Source: java.exe, 00000002.00000003.2161647001.0000000015465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: java.exe, 00000002.00000003.2161647001.0000000015465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: java/lang/VirtualMachineError.classPK

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Memory protected: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe "C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\urS3jQ9qb5.jar"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory=Default	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get name	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Caption /value	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\HOSTNAME.EXE hostname	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe	Jump to behavior

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\7076 VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jsse.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jfr.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\jartracer.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\edgecookies.txt VolumeInformation	Jump to behavior

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Can Stealer

Source: Yara match	File source: 00000002.00000003.2435946154.00000000169E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2643684011.00000000169AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2435636231.0000000016987000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: java.exe PID: 7076, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Source: Yara match

File source: Process Memory Space: java.exe PID: 7076, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default

Yara detected Can Stealer

Source: Yara match	File source: 00000002.00000003.2435946154.00000000169E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2643684011.00000000169AC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2435636231.0000000016987000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: java.exe PID: 7076, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Services File Permissions Weakness	111 Process Injection	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Services File Permissions Weakness	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Exploitation for Client Execution	Logon Script (Windows)	1 DLL Side-Loading	11 Disable or Modify Tools	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	13 System Information Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Services File Permissions Weakness	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	4 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
urS3jQ9qb5.jar	3%	Virustotal		Browse
urS3jQ9qb5.jar	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\jna-1820491375\jna5340335501256029183.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\sqlite-3.20.1-2b1cbfdc-5534-4adc-ad94-dd4ff06aa3aa-sqlitejdbc.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://repository.luxtrust.lu3	0%	Avira URL Cloud	safe
http://www.chambersign.org	0%	Avira URL Cloud	safe
http://crl.chambersign.org/chambersroot.crl	0%	Avira URL Cloud	safe
https://paste-pgpj.onrender.com/?p=ava/l	0%	Avira URL Cloud	safe
https://canstealer.com/kaancevik63	100%	Avira URL Cloud	malware
http://cps.chambersign.org/cps/chambersroot.html	0%	Avira URL Cloud	safe
https://repository.luxtrust.lu	0%	Avira URL Cloud	safe
https://canstealer.com/	100%	Avira URL Cloud	malware
https://paste-pgpj.onrender.com/?p=	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
canstealer.com	104.21.76.84	true	false	high
plus.l.google.com	142.250.181.46	true	false	high
play.google.com	142.250.181.110	true	false	high
raw.githubusercontent.com	185.199.110.133	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
www.google.com	142.250.181.132	true	false	high
api.telegram.org	149.154.167.220	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
api.gofile.io	45.112.123.126	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ/cb=gapi.loaded_0	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://www.google.com/async/newtab_promos	false	high
https://play.google.com/log?format=json&hasfast=true	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.slf4j.org/codes.html#version_mismatch	java.exe, 00000002.00000002.2642541893.0000000015CD0000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2273557661.00000000159D8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2273763754.00000000159E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.chambersign.org/chambersroot.crl0	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org	java.exe, 00000002.00000002.2617226534.000000000535E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.discordapp.com/embed/avatars/0.pngw	java.exe, 00000002.00000003.2435946154.00000000169E5000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2435636231.0000000016987000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2643684011.00000000169AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	java.exe, 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000003.2383624447.00000000159A8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://repository.luxtrust.lu3	java.exe, 00000002.00000003.2393293665.000000000B000000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.slf4j.org/codes.html#multiple_bindings	java.exe, 00000002.00000003.2273763754.00000000159E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://repository.luxtrust.lu0	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFE7000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000003.2393293665.000000000B000000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cps.chambersign.org/cps/chambersroot.html0	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.discordapp.com/avatars/.ldb	java.exe, 00000002.00000003.2435636231.0000000016987000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2643684011.00000000169AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.slf4j.org/codes.html#unsuccessfulInit	java.exe, 00000002.00000002.2642541893.0000000015CD0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.chambersign.org1	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/0	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/TooTallNate/Java-WebSocket/wiki/Lost-connection-detection	java.exe, 00000002.00000003.2383624447.00000000159A8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2273557661.00000000159D8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2273763754.00000000159E8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://policy.camerfirma.com	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/botss	java.exe, 00000002.00000003.2435946154.00000000169E5000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2435636231.0000000016987000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2643684011.00000000169AC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.slf4j.org/codes.htmlU	java.exe, 00000002.00000003.2383624447.00000000159A8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2273557661.00000000159D8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2273763754.00000000159E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ocsp.quovadisoffshore.com	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl0	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/sonriseclient/kaancevik6-startup-6107/main/Java.jar	java.exe, 00000002.00000002.2617226534.0000000005199000.00000004.00000800.00020000.00000000.sdmp	false		high
https://repository.luxtrust.lu	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000003.2393293665.000000000B000000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.quovadisglobal.com/cps0	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://null.oracle.com/B	java.exe, 00000002.00000002.2642541893.000000001607F000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2435417835.000000001607F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.slf4j.org/codes.html#unsuccessfulInitG	java.exe, 00000002.00000002.2642541893.0000000015CD0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.gofile.io/serversKu	java.exe, 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ocsp.quovadisoffshore.com0	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.slf4j.org/codes.html#unsuccessfulInit;	java.exe, 00000002.00000003.2274039052.0000000015DB5000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642541893.0000000015CD0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.chambersign.org	java.exe, 00000002.00000002.2638926084.000000000AB1C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot7771186573:AAHGj8VtumJ9kjTUYRUQm886fmn2UiPGXSk/sendMessage	java.exe, 00000002.00000002.2617226534.000000000535E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://policy.camerfirma.com0	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crl	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/TooTallNate/Java-WebSocket/wiki/Lost-connection-detection/lang/	java.exe, 00000002.00000002.2641835595.00000000156E1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://paste-pgpj.onrender.com/?p=ava/l	java.exe, 00000002.00000003.2437014648.0000000015F3F000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642541893.0000000015EDB000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2435417835.0000000015F1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://paste-pgpj.onrender.com/?p=	java.exe, 00000002.00000003.2383624447.00000000159A8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.gofile.io/servers	java.exe, 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://bugreport.sun.com/bugreport/	java.exe, 00000002.00000002.2638926084.000000000A5F7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.slf4j.org/codes.html#replay	java.exe, 00000002.00000002.2642541893.0000000015CD0000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://null.oracle.com/	java.exe, 00000002.00000002.2642541893.000000001607F000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2435417835.000000001607F000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2644197266.0000000016DC8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2434809680.0000000016D81000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.slf4j.org/codes.html#substituteLogger	java.exe, 00000002.00000002.2642541893.0000000015CD0000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2273557661.00000000159D8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2273763754.00000000159E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.slf4j.org/codes.html#loggerNameMismatch	java.exe, 00000002.00000002.2642541893.0000000015CD0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cps	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cps.chambersign.org/cps/chambersroot.html	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.slf4j.org/codes.html#noProviders	java.exe, 00000002.00000002.2642541893.0000000015CD0000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A5F3000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A610000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.slf4j.org/codes.html#ignoredBindings	java.exe, 00000002.00000002.2642541893.0000000015CD0000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://canstealer.com/	java.exe, 00000002.00000002.2617226534.000000000500F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://raw.githubusercontent.com	java.exe, 00000002.00000002.2617226534.0000000005199000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crl0	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.slf4j.org/codes.html#noProvidersionL	java.exe, 00000002.00000003.2383624447.00000000159A8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.discordapp.com/embed/avatars/0.png	java.exe, 00000002.00000003.2383624447.00000000159A8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2435946154.00000000169E5000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2435636231.0000000016987000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2643684011.00000000169AC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.quovadis.bm	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.quovadis.bm0	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000AFA5000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000002.00000002.2638926084.000000000A7C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.gofile.io/serversC3	java.exe, 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp	false		high
https://canstealer.com/kaancevik63	java.exe, 00000002.00000002.2617226534.000000000546E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.slf4j.org/codes.html#substituteLogger/M	java.exe, 00000002.00000003.2383624447.00000000159A8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2273557661.00000000159D8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000003.2273763754.00000000159E8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.discordapp.com/avatars/	java.exe, 00000002.00000003.2383624447.00000000159A8000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642124750.000000001599E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.slf4j.org/codes.html	java.exe, 00000002.00000003.2274039052.0000000015DB5000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000002.00000002.2642541893.0000000015CD0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.chambersign.org/chambersroot.crl	java.exe, 00000002.00000002.2638926084.000000000A9B0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
142.250.181.110	play.google.com	United States	15169	GOOGLEUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.76.84	canstealer.com	United States	13335	CLOUDFLARENETUS	false
142.250.181.46	plus.l.google.com	United States	15169	GOOGLEUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
185.199.110.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
45.112.123.126	api.gofile.io	Singapore	16509	AMAZON-02US	false

Private

IP
192.168.2.16
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577278
Start date and time:	2024-12-18 10:57:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsfilecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	69
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Java) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	urS3jQ9qb5.jar renamed because original name is a hash value
Original Sample Name:	0781770e55d04cd363e0da0b168cb8550db96faf6790fd7a17b216d80b0bff43.jar
Detection:	MAL
Classification:	mal96.troj.spyw.expl.evad.winJAR@167/111@25/14
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .jar

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 172.217.19.206, 13.107.6.158, 172.165.69.228, 23.32.239.18, 23.32.239.56, 2.16.158.176, 2.16.158.169, 2.16.158.187, 2.16.158.96, 2.16.158.83, 2.16.158.170, 2.16.158.186, 2.16.158.91, 2.16.158.179, 142.250.181.99, 64.233.164.84, 172.217.17.46, 192.229.221.95, 142.250.181.74, 142.250.181.10, 172.217.17.74, 172.217.19.234, 142.250.181.106, 142.250.181.138, 172.217.17.42, 172.217.19.10, 172.217.19.202, 142.250.181.42, 199.232.214.172, 172.217.17.67, 172.217.19.170, 172.217.21.42, 216.58.208.234, 172.217.17.35, 94.245.104.56, 13.107.246.63, 23.218.208.109, 4.175.87.197
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, redirector.gvt1.com, config-edge-skype.l-0007.l-msedge.net, update.googleapis.com, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, optimizationguide-pa.googleapis.com, www.bing.com, clients1.google.com, edge-microsoft-com.dual-a-0036.a-msedge.net, client.wns.windows.com, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, bzib.nelreports.net.akamaized.net, accounts.google.com, otelrules.azureedge.net, api.edgeoffer.microsoft.com, a-0003.a-msedge.net, ctldl.windowsupdate.com, ogads-pa.googleapis.com, www-msn-com.a-0003.a-msedge.net, b-0005.b-msedge.net, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.traffi
Execution Graph export aborted for target java.exe, PID 7076 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Reached maximum number of file to list during submission archive extraction
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:58:43	API Interceptor	3x Sleep call for process: WMIC.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.61.3	EXTERNALRe.msg	Get hash	malicious	Unknown	Browse
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse
	https://garfieldthecat.tech/Receipt.html	Get hash	malicious	WinSearchAbuse	Browse
	CapCut_12.0.4_Installer.exe	Get hash	malicious	LummaC Stealer	Browse
	122046760.bat	Get hash	malicious	RHADAMANTHYS	Browse
	pkqLAMAv96.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	IIC0XbKFjS.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	873406390.bat	Get hash	malicious	RHADAMANTHYS	Browse
	0J3fAc6cHO.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	KjECqzXLWp.lnk	Get hash	malicious	RHADAMANTHYS	Browse
149.154.167.220	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	FileScanner.exe	Get hash	malicious	Unknown	Browse
	PK241200518-EMAIL RELEASE-pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	stealer.jar	Get hash	malicious	Can Stealer	Browse
	stealer.jar	Get hash	malicious	Can Stealer	Browse
	zyEDYRU0jw.exe	Get hash	malicious	Arcane	Browse
	zyEDYRU0jw.exe	Get hash	malicious	Arcane	Browse
	ugpJX5h56S.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	87h216Snb7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	dP5z8RpEyQ.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
104.21.76.84	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse
104.21.76.84	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse
185.199.110.133	sys_upd.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_menu..ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_phshop..ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_atCAD.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	xK44OOt7vD.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	SecuriteInfo.com.Trojan.GenericKD.74126573.27896.28845.dll	Get hash	malicious	Metasploit	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber_mnr.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	EXTERNALRe.msg	Get hash	malicious	Unknown	Browse	162.159.61.3
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	CapCut_12.0.4_Installer.exe	Get hash	malicious	LummaC Stealer	Browse	172.64.41.3
	CapCut_12.0.4_Installer.exe	Get hash	malicious	LummaC Stealer	Browse	162.159.61.3
	122046760.bat	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
	pkqLAMAv96.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
	IIC0XbKFjS.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
	873406390.bat	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	0J3fAc6cHO.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
	#U041e#U043f#U043b#U0430#U0442#U0430.xls	Get hash	malicious	Unknown	Browse	172.64.41.3
canstealer.com	stealer.jar	Get hash	malicious	Can Stealer	Browse	172.67.191.110
	stealer.jar	Get hash	malicious	Can Stealer	Browse	172.67.191.110
	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse	104.21.76.84
	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse	104.21.76.84
raw.githubusercontent.com	x0EMKX5G1g.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	185.199.108.133
	x0EMKX5G1g.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	185.199.110.133
	rbqHSouklL.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	stealer.jar	Get hash	malicious	Can Stealer	Browse	185.199.111.133
	stealer.jar	Get hash	malicious	Can Stealer	Browse	185.199.109.133
	mjjt5kTb4o.lnk	Get hash	malicious	Unknown	Browse	185.199.108.133
	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	185.199.108.133
	uZgbejeJkT.bat	Get hash	malicious	Unknown	Browse	185.199.108.133
	ni2OwV1y9u.bat	Get hash	malicious	Unknown	Browse	185.199.108.133
	3gJQoqWpxb.bat	Get hash	malicious	Unknown	Browse	185.199.109.133
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	EXTERNALRe.msg	Get hash	malicious	Unknown	Browse	94.245.104.56
	stealer.jar	Get hash	malicious	Can Stealer	Browse	94.245.104.56
	stealer.jar	Get hash	malicious	Can Stealer	Browse	94.245.104.56
	pkqLAMAv96.lnk	Get hash	malicious	RHADAMANTHYS	Browse	94.245.104.56
	IIC0XbKFjS.lnk	Get hash	malicious	RHADAMANTHYS	Browse	94.245.104.56
	873406390.bat	Get hash	malicious	RHADAMANTHYS	Browse	94.245.104.56
	0J3fAc6cHO.lnk	Get hash	malicious	RHADAMANTHYS	Browse	94.245.104.56
	69633f.msi	Get hash	malicious	Vidar	Browse	94.245.104.56
	cey4VIyGKh.lnk	Get hash	malicious	RHADAMANTHYS	Browse	94.245.104.56
	dZKPE9gotO.exe	Get hash	malicious	Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	FileScanner.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	PK241200518-EMAIL RELEASE-pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	stealer.jar	Get hash	malicious	Can Stealer	Browse	149.154.167.220
	stealer.jar	Get hash	malicious	Can Stealer	Browse	149.154.167.220
	zyEDYRU0jw.exe	Get hash	malicious	Arcane	Browse	149.154.167.220
	zyEDYRU0jw.exe	Get hash	malicious	Arcane	Browse	149.154.167.220
	Setup.msi	Get hash	malicious	Vidar	Browse	149.154.167.99
	ugpJX5h56S.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	87h216Snb7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	https://2024sharepointonline.z28.web.core.windows.net/	Get hash	malicious	Unknown	Browse	104.16.20.118
	https://cc.naver.com/cc?a=pst.link&m=1&nsc=Mblog.post&u=https://prestamosgarantizados.com/wvr/#svk8Lh6vLh6njx3lLh6vg4Pnq07qug4Plvk8Lh6rjx3z9BR15WPy	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	EXTERNALRe.msg	Get hash	malicious	Unknown	Browse	172.64.41.3
	http://efaktura.dhlecommerce.pl	Get hash	malicious	Unknown	Browse	104.18.86.42
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	104.16.123.96
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	sldkjgsdGarDe3.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	jhsdfggga13.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
CLOUDFLARENETUS	https://2024sharepointonline.z28.web.core.windows.net/	Get hash	malicious	Unknown	Browse	104.16.20.118
	https://cc.naver.com/cc?a=pst.link&m=1&nsc=Mblog.post&u=https://prestamosgarantizados.com/wvr/#svk8Lh6vLh6njx3lLh6vg4Pnq07qug4Plvk8Lh6rjx3z9BR15WPy	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	EXTERNALRe.msg	Get hash	malicious	Unknown	Browse	172.64.41.3
	http://efaktura.dhlecommerce.pl	Get hash	malicious	Unknown	Browse	104.18.86.42
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	104.16.123.96
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	sldkjgsdGarDe3.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	jhsdfggga13.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	20.198.119.143
	x0EMKX5G1g.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	20.198.119.143
	sldkjgsdGarDe3.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	20.198.119.143
	jhsdfggga13.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	20.198.119.143
	Garsdgwqa13de.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	20.198.119.143
	x0EMKX5G1g.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	20.198.119.143
	twjMb9cX64.exe	Get hash	malicious	Sliver	Browse	20.198.119.143
	WOlxr4yjgF.exe	Get hash	malicious	Sliver	Browse	20.198.119.143
	credit.js	Get hash	malicious	PureLog Stealer, RHADAMANTHYS	Browse	20.198.119.143
	PK241200518-EMAIL RELEASE-pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	20.198.119.143

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\jna-1820491375\jna5340335501256029183.dll	stealer.jar	Get hash	malicious	Can Stealer	Browse
	stealer.jar	Get hash	malicious	Can Stealer	Browse
	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse
	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse
	bZPAo2e2Pv.jar	Get hash	malicious	Can Stealer	Browse
	bZPAo2e2Pv.jar	Get hash	malicious	Can Stealer	Browse
	soinjector.exe	Get hash	malicious	Unknown	Browse
	https://www.eclipse.org/downloads/download.php?file=/oomph/epp/2024-03/R/eclipse-inst-jre-win64.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\sqlite-3.20.1-2b1cbfdc-5534-4adc-ad94-dd4ff06aa3aa-sqlitejdbc.dll	stealer.jar	Get hash	malicious	Can Stealer	Browse
	stealer.jar	Get hash	malicious	Can Stealer	Browse
	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse
	t1gY0BGmOZ.jar	Get hash	malicious	Can Stealer	Browse
	bZPAo2e2Pv.jar	Get hash	malicious	Can Stealer	Browse
	bZPAo2e2Pv.jar	Get hash	malicious	Can Stealer	Browse
	soinjector.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Oracle\Java\.oracle_jre_usage\b5820291038aa69c.timestamp

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.873140679513134
Encrypted:	false
SSDEEP:	3:oFj4I5vpm4USAJ:oJ5bG
MD5:	1713B874A9C391103FA64F92DA39F4D7
SHA1:	6A71209E9211C5321DB879BBAA70E6C79746A0D7
SHA-256:	D65EF6AEB70875CD5DE6182E9E5CED91141BE49F291ED6731BCC78A8310EE1C8
SHA-512:	09122CE09A644786794220D53C5F0A75BB3AB0E11558B71CC2BA240E7F2705379B3591D1218FCE17D431937382DB8F5242404BCD45DC18B6AFCE493984DEE94D
Malicious:	false
Preview:	C:\Program Files (x86)\Java\jre-1.8..1734515894986..

C:\Users\user\AppData\Local\Microsoft\724536.zip

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	554286
Entropy (8bit):	7.998259586800744
Encrypted:	true
SSDEEP:	12288:6mwUczK5780E/KJDa8rToEXPkF0YyfM6P+PDvbvpjxq5ID:d0HX/KNTkEfrYHvLpjxt
MD5:	7E4DE0A279378F94FED2C4197406B3DE
SHA1:	A27A0C26D2E340EBFD7BC163106AC812E6A5C3F9
SHA-256:	4904EA96BE06901B607B6617C3DD60E6CE0F9352D4C92BF9E5C4A78A25581DDA
SHA-512:	6E5A693298DFE825CB8F1D99D71F8C00CE37E48E394E31DECFA18CE1ABBA67E218BE0D834B5143B0EF1C1C0603EBAB88C759E89BF01F6460C05B12D3BE8E606D
Malicious:	false
Preview:	PK........Q'.Y............"...Browsers/Microsoft Edge/cookie.txt..;k.@.....I'..tO...{8...%.H#....)&.;..(]:....>vf...._.{V...Y.S..P.(SH.Y.[\|L.l.%.....a.v.O...W7.n..4.q^.?....a.0......).#9.D.;R.06_R..\..D...n..^....Mu>....^.c`@..d,r.4...TB...kLvS.?.............c(.2...4Fc."..+R!iri+.<..PK...!0.........PK........Q'.Y............$...Browsers/Microsoft Edge/password.txt..PK..............PK........Q'.Y................Game/craftrise.txt.........PK..g.C.........PK........Q'.Y................Game/sonoyuncu.txt.........PK..g.C.........PK........Q'.Y................screenshot.png,.eX....gwYj)A.D......2h..k...DA1.n).]@...D....n%....=.{f^...s_.y~.{f..\|NN.D.......m.........A...6. ..'..}....>.....z....;:v;....;Z..:.\'.Wd.=Az..........3n...&.ijiN.Z...h....Om.h.*..0y.-Q_.^....Y.Y./...:3......\....Z..=. .#.Q..A.....#.3.Ue..C?.<.......i...._...4U.<..@,.......-.aD............5.#....6.Y...0..a../....M.vg3.6.._l.;E~k.{.+..C.Y.......F?<.U/..+.].=W.a.cAk......2.......{...

C:\Users\user\AppData\Local\Microsoft\724536\Browsers\Microsoft Edge\cookie.txt (copy)

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	540
Entropy (8bit):	5.210618767812939
Encrypted:	false
SSDEEP:	12:379gj796LP79Bf1XmOc4rj9Z79im+79dy/9bVGGn9l:RQ6BNXa4fitqxV9l
MD5:	C9242A2A653E5A074E89F41B831907E3
SHA1:	611DD4E105B285E96ED682C8B0F4E09DBDE57698
SHA-256:	83711207BBC0400269C8EFC027489C3B7110AA79FC648B39F6ADC4276983AF7E
SHA-512:	9B56B6BC1354EB7A55FD2F2D75DACBE1A4125596AF1B18C100DF29DFD097A9B4967CAF3D1C18B250ACB2D37FB370A8BE75864D2F8E6D447B3DEE676071AA18B1
Malicious:	false
Preview:	ntp.msn.com.TRUE./.FALSE.2597573456._C_Auth...msn.com.TRUE./.FALSE.2597573456._C_ETH.1.ntp.msn.com.TRUE./.FALSE.2597573456.sptmarket.en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=DAD4FD1CC31344ACAB9A2BB7C9B56378.RefC=2024-12-18T09:58:21Z..msn.com.TRUE./.FALSE.2597573456.USRLOC...msn.com.TRUE./.FALSE.2597573456.MUID.1B0CEF78A0896BA91FF5FA21A1906AF8.ntp.msn.com.TRUE./.FALSE.2597573456.MUIDB.1B0CEF78A0896BA91FF5FA21A1906AF8..msn.com.TRUE./.FALSE.2597573456._EDGE_S.F=1&SID=04AC7D5CB4776A312DB26805B5DF6B9F..msn.com.TRUE./.FALSE.2597573456._EDGE_V.1.

C:\Users\user\AppData\Local\Microsoft\724536\Game\craftrise.txt

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	2.186704345910025
Encrypted:	false
SSDEEP:	3:blVOM:BVj
MD5:	C4E084CD947C96A0B82B02C634540789
SHA1:	DE91618BAF7ECCBAD86A0610176B6BE79E16A094
SHA-256:	C926A5B9148DEECB9084D03187B9297B501296DE20F87DB2B689066C3FBB34D2
SHA-512:	C2D288B2EE229C8EDD1250284322A118B06A847AD05E076F4F028ACD5A060864A4F6DBE77C091707AFF49663E3A6D7C8E173DDC83220C44DF6468C02E7EB7E85
Malicious:	false
Preview:	Yokki:Yokki

C:\Users\user\AppData\Local\Microsoft\724536\Game\sonoyuncu.txt

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	2.186704345910025
Encrypted:	false
SSDEEP:	3:blVOM:BVj
MD5:	C4E084CD947C96A0B82B02C634540789
SHA1:	DE91618BAF7ECCBAD86A0610176B6BE79E16A094
SHA-256:	C926A5B9148DEECB9084D03187B9297B501296DE20F87DB2B689066C3FBB34D2
SHA-512:	C2D288B2EE229C8EDD1250284322A118B06A847AD05E076F4F028ACD5A060864A4F6DBE77C091707AFF49663E3A6D7C8E173DDC83220C44DF6468C02E7EB7E85
Malicious:	false
Preview:	Yokki:Yokki

C:\Users\user\AppData\Local\Microsoft\724536\screenshot.png

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	557960
Entropy (8bit):	7.9226465797324535
Encrypted:	false
SSDEEP:	12288:7A8hAO/Uvh0F4dXc1kOj40vNRCq8DDTGMD1LFmqDCcJULE5nLD:7JUp64oj1LGLlgqD56MD
MD5:	3927C0E51A20FA26FE4B9C5B5D3AAC7C
SHA1:	EAFC598F7DBC85B621F8C03CB5E205F7455A0277
SHA-256:	EDE02F3EE40515BBB4C398633FB50D8F1A0399C14C9FE55A2E982FC650A444B0
SHA-512:	E50066FF829408D93FFFDA09C2E7CA99694441C863ED65884446BFE95BE23CD98B6EB3FFE8E290981ED4337A496203FF0A6A105A005CA0909AF6EC70F13ACA80
Malicious:	false
Preview:	.PNG........IHDR.............1.c.....IDATx..y.\U....=v..zjll.lj..?zlf..k.......D.v..$..'d&.F&.I&.%;.;$$.U.H..)..Ehe..I..@.h...w....=.c.B.e..{.}.d....}...E{.....Jhw.pW....`.BJ=>X...>..z.....rz..x2.J....\|......y(R....vBXp;...JQ...)......W...C.{.......Q..jG^...W.;.P..m....)u.V....._}RD.[.P.[.t.J.....GC..?..R?...F..6......O7....u..y..1...R?.X.2?\|.J.`CI..{%u..P..Q..R....y.1J..-...er......-......m<.W..W.+}..x..\.l..m..oB.....5..t....:.+}.H...2......pUp....T]..s.*(}.J<......;UF......oS...........q.....>./....P...(.y....N......5.VV......j...a......_Q=..jnw~.Y.9.'}NwjvW0........k.w..[7..vno5..t.Y...t.g.........<.M.....'P..........;..Y.....=w....g...]....mxf.......jM.h...jfw..L_...:......-.kgv..^}V..\s[5.5=myfz..5....VMk..HOY.e.....W.Ie..B.-..)-U.[2....\.E..6....f.....zJ...?.e<k...Ln...'.Ug.OOh.L\...\|K......c.;X.c...7.m0..[^.o..q...'...Q..Z.....W....~J..x...Cw....-U..Ll...mzlsp.....\|......wp.s..XKx...5..G .y...... ....e...[.R..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0dd1aa5d-ef03-411c-bd50-c643a5d48d7f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44922
Entropy (8bit):	6.094587040760675
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJsi1zNt7crNknY1+p/AQKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yniE0KtSmd6qE7lFoC
MD5:	7F31E7748F8BCFE03D4971969CDD0CDC
SHA1:	D7873EA7F5F66FD1EFCD55D65524CDD8E13EB248
SHA-256:	BFF046549666904F47D84083753FFB19C41BBC270B8A1F0125A9547CAEF0F20C
SHA-512:	DB18CA3575F09B256F8761BE14F29A3C9A863B350664E5ECFDC278B88D7394FAC5601BF825C3F83C3D5676AC4494EC11AA7C68AEA11F22680E1A77C5EEDD7B03
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\89618a08-e929-45ed-a3f0-2e3da3e4a9c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45000
Entropy (8bit):	6.094551606426149
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xW/si1zNt7cr9vnZMEZuLKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yOcEQKtSmd6qE7lFoC
MD5:	9BBDF66C42310E07918CDD4D0E18A903
SHA1:	05CE37A66C0210729DF17C3C60A355A6B2481456
SHA-256:	C2EF9D4E07A54A79B5605171B081F34F4F62BC3CA0955D55243FE091DDD5E9AC
SHA-512:	8BAF364B58631BF902CB519FB02B587CC909A70E8403DA8B028464C74C99170EBD29ED85DC01DA417A756DC9048A341E0AE67E5C140D305F02EFD3D3E969A0A9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67629CB8-FF4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.298902796848323
Encrypted:	false
SSDEEP:	3072:1pfFceJOZFQwmDZBGCnVKao0Dvbd714H:3FcTFkBGIVKaNR14
MD5:	ECDEF4365A79CCABF2587EA223F8BAAC
SHA1:	C1006747B9BD420ECDDF509783D605B2AD5FE713
SHA-256:	62EEE25C9A9616E29E6EECFDA9F1920BD426DAAA6B07F1508FC4797F83E1593F
SHA-512:	2935A93821926EFC14B9BE75746778AB78176F73E63A9DAB85AD7E45DC35EAB5C46124F1441E4C507A3D3A592B4FF3E097B945DD5D754AFC088194B353530C05
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".uasqhk20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@................................... w..U?:K.7DD._.....G.......W6L..].>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3a194add-b9e0-4cfa-b0c9-3d7108ebeb7c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.242234705555945
Encrypted:	false
SSDEEP:	6:7TH1N723oH+Tcwtp3hBtB2KLlpTFFd+q2PN723oH+Tcwtp3hBWsIFUv:7jaYebp3dFLTsvVaYebp3eFUv
MD5:	5973FE35E6E984FCCE860B2684106707
SHA1:	604A0FE4081E8DDE6ADE0E52A1C543429F6FF093
SHA-256:	ED55B8C6502BEC17B52E6B7223174E565F119856A301E31758CA9444164A7677
SHA-512:	76C5F1CB46D0942305645B017BA65CF9A881A5A5CB98CFBE78804D766221FE79A0D5CDD1CE224F0A456189929E1349D4B401728F32B748A30841B7536C27DBCE
Malicious:	false
Preview:	2024/12/18-04:58:22.725 e78 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/12/18-04:58:22.776 e78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	340
Entropy (8bit):	5.107860264817874
Encrypted:	false
SSDEEP:	6:7Twq2PN723oH+Tcwt9Eh1tIFUt8OT60Zmw+OTzF0kwON723oH+Tcwt9Eh15LJ:7UvVaYeb9Eh16FUt8OG0/+OK5OaYeb9O
MD5:	DBCDA9D4A3D4BAA7B1737D252DE6DB1A
SHA1:	719B629AB0DBDC0DFC857F14C7AF6B1F2DDE92A3
SHA-256:	90D7DCA9272C7567D4B4327810AD87C4F361AF583718B93180BC0829F4104645
SHA-512:	CBFC780E2E7C351ED3694B7DC05213FDFD9110D4F496258A78816C54848EFE1165B2CC6E4D059C4287BCA7C004382C5142A4EA6E61BFC94EDA37D2CC7840558D
Malicious:	false
Preview:	2024/12/18-04:58:22.399 20a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/18-04:58:22.403 20a4 Recovering log #3.2024/12/18-04:58:22.417 20a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.107860264817874
Encrypted:	false
SSDEEP:	6:7Twq2PN723oH+Tcwt9Eh1tIFUt8OT60Zmw+OTzF0kwON723oH+Tcwt9Eh15LJ:7UvVaYeb9Eh16FUt8OG0/+OK5OaYeb9O
MD5:	DBCDA9D4A3D4BAA7B1737D252DE6DB1A
SHA1:	719B629AB0DBDC0DFC857F14C7AF6B1F2DDE92A3
SHA-256:	90D7DCA9272C7567D4B4327810AD87C4F361AF583718B93180BC0829F4104645
SHA-512:	CBFC780E2E7C351ED3694B7DC05213FDFD9110D4F496258A78816C54848EFE1165B2CC6E4D059C4287BCA7C004382C5142A4EA6E61BFC94EDA37D2CC7840558D
Malicious:	false
Preview:	2024/12/18-04:58:22.399 20a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/18-04:58:22.403 20a4 Recovering log #3.2024/12/18-04:58:22.417 20a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.42018985553305144
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96Uwcc25fBI:TouQq3qh7z3bY2LNW9WMcU1cmB
MD5:	BAC1D097FF864A3C9220C41ED555163B
SHA1:	130D554BA6B9579CF1DC4B0F2C20EC2CA67FD6AB
SHA-256:	C2507C343404D8DE5AE9EB20E541CAEC1E7C561268D11D3D325615C41648D915
SHA-512:	5432235823822EBFC6737FF6B53BBB571E1E16BF2D44571A3EF4468CFD3FF5F3D61464D833D32D4CFFB79B1A74979E07290A2CF9ACC3071FEE0EA43263679F00
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2272535625431187
Encrypted:	false
SSDEEP:	3:7FEG2l9XtCtylNlljq7A/mhWJFuQ3yy7IOWUXEx/4dgqz1zGcSFZBWopCV9RUIrr:7+/l9XU75fO9ExQdguxtscopWxr
MD5:	A0B2965F74D4B8307EA825DF358B81B1
SHA1:	5B5B7E3EE87FE4B9409C8559A034FA2FFDFCA76E
SHA-256:	47971E04193E0C6851E0515A47D639B5C74A08B644E1308FE9C8D6FE7C73A1F5
SHA-512:	6AE93A4309A6B68F2DAEC1267900D96FFEBADACDFAAA491E00D757F5645C210D140BA1BF2ABB26C8E13393EE7F0B7BFD1813B8F9C2934903BAC69F9A103DE1D0
Malicious:	false
Preview:	.... .c.....2aa.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.220534760061462
Encrypted:	false
SSDEEP:	6:7lIq2PN723oH+TcwtnG2tMsIFUt8OmZmw+OakwON723oH+TcwtnG2tMsLJ:7lIvVaYebn9GFUt8Om/+Oa5OaYebn95J
MD5:	A817B4CDA598913616E01C81344D6786
SHA1:	6343B149BE433445D5CE66940084FBC211B2D713
SHA-256:	9348C9D82F59CC6F27360E515955FBC6E8C08D908B7D9ACD9CA6829FA7008D46
SHA-512:	8119E6FD0B558AD23D98E858BA00B6CF1FEA75313F31F3ADA7A298EBA1A4CF4F5D3B36876ECA9E8BAA53FE329D07846D3F9B91E3D60D8131D45B8FDFF20F80F4
Malicious:	false
Preview:	2024/12/18-04:58:17.316 e74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/18-04:58:17.317 e74 Recovering log #3.2024/12/18-04:58:17.317 e74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.220534760061462
Encrypted:	false
SSDEEP:	6:7lIq2PN723oH+TcwtnG2tMsIFUt8OmZmw+OakwON723oH+TcwtnG2tMsLJ:7lIvVaYebn9GFUt8Om/+Oa5OaYebn95J
MD5:	A817B4CDA598913616E01C81344D6786
SHA1:	6343B149BE433445D5CE66940084FBC211B2D713
SHA-256:	9348C9D82F59CC6F27360E515955FBC6E8C08D908B7D9ACD9CA6829FA7008D46
SHA-512:	8119E6FD0B558AD23D98E858BA00B6CF1FEA75313F31F3ADA7A298EBA1A4CF4F5D3B36876ECA9E8BAA53FE329D07846D3F9B91E3D60D8131D45B8FDFF20F80F4
Malicious:	false
Preview:	2024/12/18-04:58:17.316 e74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/18-04:58:17.317 e74 Recovering log #3.2024/12/18-04:58:17.317 e74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.1411535354913305
Encrypted:	false
SSDEEP:	6:7Tj1N723oH+Tcwtk2WwnvB2KLlpTdF1E1L+q2PN723oH+Tcwtk2WwnvIFUv:7XaYebkxwnvFLTre9+vVaYebkxwnQFUv
MD5:	8213B13EF1DE7FDA6FAAEDBF734B3186
SHA1:	D5BDD6ABEB7A69D8ECBE1C6B962A8B30B52E6345
SHA-256:	6757B2D14BBD8EBF5642C9DD16D4513FDE12DBF8334DBC260590D118677D29E3
SHA-512:	9D3E47E3F67F09E4F344C8AEDA81900741175D3359AFA3F085C9A5BE26D75DE62CB65C3BD1D62132FD62E03A6C6BB526F3BCAECADEDF0CCE7BB0CBB8C7800DA5
Malicious:	false
Preview:	2024/12/18-04:58:22.524 219c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/12/18-04:58:22.718 219c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	380
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
MD5:	9FE07A071FDA31327FA322B32FCA0B7E
SHA1:	A3E0BAE8853A163C9BB55F68616C795AAAF462E8
SHA-256:	E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
SHA-512:	9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.221659766486255
Encrypted:	false
SSDEEP:	6:7Hq2PN723oH+Tcwt8aPrqIFUt8OHFZZmw+OHFzkwON723oH+Tcwt8amLJ:7HvVaYebL3FUt8O3/+Ol5OaYebQJ
MD5:	97AB17B3E2EA405DEBEB574288DBEF0B
SHA1:	E049F8335D502CAA2FE4B2C62A5F52D4BC1E767E
SHA-256:	C7ACC69C7298B682CD2226453CCE303196F2E7DF7182872E96A4196DECCE2D4C
SHA-512:	44FCCDD014AEDE6942810337A30DFFE36F8A35F132E600989BA76C3C168012C12B93913A30DDD8A9BD28E2FD79B2A52473BDB65A08F30C967FA89B6DC033B596
Malicious:	false
Preview:	2024/12/18-04:58:17.375 19f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/18-04:58:17.376 19f0 Recovering log #3.2024/12/18-04:58:17.376 19f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.221659766486255
Encrypted:	false
SSDEEP:	6:7Hq2PN723oH+Tcwt8aPrqIFUt8OHFZZmw+OHFzkwON723oH+Tcwt8amLJ:7HvVaYebL3FUt8O3/+Ol5OaYebQJ
MD5:	97AB17B3E2EA405DEBEB574288DBEF0B
SHA1:	E049F8335D502CAA2FE4B2C62A5F52D4BC1E767E
SHA-256:	C7ACC69C7298B682CD2226453CCE303196F2E7DF7182872E96A4196DECCE2D4C
SHA-512:	44FCCDD014AEDE6942810337A30DFFE36F8A35F132E600989BA76C3C168012C12B93913A30DDD8A9BD28E2FD79B2A52473BDB65A08F30C967FA89B6DC033B596
Malicious:	false
Preview:	2024/12/18-04:58:17.375 19f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/18-04:58:17.376 19f0 Recovering log #3.2024/12/18-04:58:17.376 19f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	380
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
MD5:	9FE07A071FDA31327FA322B32FCA0B7E
SHA1:	A3E0BAE8853A163C9BB55F68616C795AAAF462E8
SHA-256:	E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
SHA-512:	9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.202959447516076
Encrypted:	false
SSDEEP:	6:7xGq2PN723oH+Tcwt865IFUt8Ox/Zmw+OxtkwON723oH+Tcwt86+ULJ:7xGvVaYeb/WFUt8Ox//+Oxt5OaYeb/+e
MD5:	1654EAAB4D81FDCFE336F7D970852083
SHA1:	FBAA10D89D783282C42479C3155F7146A8619F06
SHA-256:	288AFC881BF4B7B1BFE7176A80FB06F3CF8D637BA4FD8A8D18DF635E72F6ABF4
SHA-512:	A52B5CB26BFB6D888AD8E161545162E2D8ECC70296498153EFDBC0F85F828A14877BCFCFB235B3278995869B6F1E8AEC8D75F913B26DE8EFC12205D7D110F1E4
Malicious:	false
Preview:	2024/12/18-04:58:17.433 19f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/18-04:58:17.433 19f0 Recovering log #3.2024/12/18-04:58:17.433 19f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.202959447516076
Encrypted:	false
SSDEEP:	6:7xGq2PN723oH+Tcwt865IFUt8Ox/Zmw+OxtkwON723oH+Tcwt86+ULJ:7xGvVaYeb/WFUt8Ox//+Oxt5OaYeb/+e
MD5:	1654EAAB4D81FDCFE336F7D970852083
SHA1:	FBAA10D89D783282C42479C3155F7146A8619F06
SHA-256:	288AFC881BF4B7B1BFE7176A80FB06F3CF8D637BA4FD8A8D18DF635E72F6ABF4
SHA-512:	A52B5CB26BFB6D888AD8E161545162E2D8ECC70296498153EFDBC0F85F828A14877BCFCFB235B3278995869B6F1E8AEC8D75F913B26DE8EFC12205D7D110F1E4
Malicious:	false
Preview:	2024/12/18-04:58:17.433 19f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/18-04:58:17.433 19f0 Recovering log #3.2024/12/18-04:58:17.433 19f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1140
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	914FD8DC5F9A741C6947E1AB12A9D113
SHA1:	6529EFE14E7B0BEA47D78B147243096408CDAAE4
SHA-256:	8BE3C96EE64B5D2768057EA1C4D1A70F40A0041585F3173806E2278E9300960B
SHA-512:	2862BF83C061414EFA2AC035FFC25BA9C4ED523B430FDEEED4974F55D4450A62766C2E799D0ACDB8269210078547048ACAABFD78EDE6AB91133E30F6B5EBFFBD
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.136423529633216
Encrypted:	false
SSDEEP:	6:7cLXiUWVq2PN723oH+Tcwt8NIFUt8OcLXNiZZmw+OcLXNizkwON723oH+Tcwt8+Q:78itvVaYebpFUt8O8EZ/+O8Ez5OaYeb2
MD5:	0FA420E90915A599386B3840A2D1785E
SHA1:	BE367A80AD0337A1D758E3CB2DCF9276F3D13F18
SHA-256:	EA265A85383987E3EEFEAE09F05715CD7E79E026B5691A0A84AE1DB316B1C61B
SHA-512:	12884024A3B2A2237743A11CADCB14C41B660D2080E06AF8E8247DFD28B51907B57B4F2B74A4A8809F157145EEF8E925B94F96CF62C906E5D588557F7C8752BA
Malicious:	false
Preview:	2024/12/18-04:58:18.209 1390 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/18-04:58:18.211 1390 Recovering log #3.2024/12/18-04:58:18.211 1390 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.136423529633216
Encrypted:	false
SSDEEP:	6:7cLXiUWVq2PN723oH+Tcwt8NIFUt8OcLXNiZZmw+OcLXNizkwON723oH+Tcwt8+Q:78itvVaYebpFUt8O8EZ/+O8Ez5OaYeb2
MD5:	0FA420E90915A599386B3840A2D1785E
SHA1:	BE367A80AD0337A1D758E3CB2DCF9276F3D13F18
SHA-256:	EA265A85383987E3EEFEAE09F05715CD7E79E026B5691A0A84AE1DB316B1C61B
SHA-512:	12884024A3B2A2237743A11CADCB14C41B660D2080E06AF8E8247DFD28B51907B57B4F2B74A4A8809F157145EEF8E925B94F96CF62C906E5D588557F7C8752BA
Malicious:	false
Preview:	2024/12/18-04:58:18.209 1390 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/18-04:58:18.211 1390 Recovering log #3.2024/12/18-04:58:18.211 1390 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.302508329772414
Encrypted:	false
SSDEEP:	12:7NvVaYeb8rcHEZrELFUt8Of/+ON5OaYeb8rcHEZrEZSJ:7RVaYeb8nZrExg8ODfOaYeb8nZrEZe
MD5:	5CFFED38A9777B89D7C935CEC9E555CA
SHA1:	D59D5C8A900842EA67B4A135F3E413645B2CC046
SHA-256:	1B417BEC1CA98A17BA574C8F36BF280BB271C23FAA851672B78FDB2850E8FE61
SHA-512:	EAFF378C1EACAE877AD04E827BB24578908D7DAAA4A87ECC038D05D8D49861EABAFA732B4AEBB953B0C16E035D44E9E64F14E886D089A4088044979F3C116A10
Malicious:	false
Preview:	2024/12/18-04:58:21.586 1390 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/18-04:58:21.587 1390 Recovering log #3.2024/12/18-04:58:21.587 1390 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.302508329772414
Encrypted:	false
SSDEEP:	12:7NvVaYeb8rcHEZrELFUt8Of/+ON5OaYeb8rcHEZrEZSJ:7RVaYeb8nZrExg8ODfOaYeb8nZrEZe
MD5:	5CFFED38A9777B89D7C935CEC9E555CA
SHA1:	D59D5C8A900842EA67B4A135F3E413645B2CC046
SHA-256:	1B417BEC1CA98A17BA574C8F36BF280BB271C23FAA851672B78FDB2850E8FE61
SHA-512:	EAFF378C1EACAE877AD04E827BB24578908D7DAAA4A87ECC038D05D8D49861EABAFA732B4AEBB953B0C16E035D44E9E64F14E886D089A4088044979F3C116A10
Malicious:	false
Preview:	2024/12/18-04:58:21.586 1390 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/18-04:58:21.587 1390 Recovering log #3.2024/12/18-04:58:21.587 1390 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.194438454590485
Encrypted:	false
SSDEEP:	6:792YL+q2PN723oH+Tcwt8a2jMGIFUt8O9V1Zmw+O9y0FLVkwON723oH+Tcwt8a23:792dvVaYeb8EFUt8O9V1/+O9X5OaYebw
MD5:	91848343C6FF5F7AD62332D6C666583A
SHA1:	40073E208FD626A9B11E216BE3C7B73361CA674D
SHA-256:	C00237822B8918C771C50243BD2D4DF343C687C7628E2796B2B43D5B206E43E5
SHA-512:	890F89370ADA8D762A6AF43EDFC229581C73C3E2FD47E123C49321474BC9474AD8E28C428B5082DE8645A88A30845B2642948CC8242EF7016175A7A59C34349D
Malicious:	false
Preview:	2024/12/18-04:58:17.809 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/18-04:58:17.865 1c98 Recovering log #3.2024/12/18-04:58:17.870 1c98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.194438454590485
Encrypted:	false
SSDEEP:	6:792YL+q2PN723oH+Tcwt8a2jMGIFUt8O9V1Zmw+O9y0FLVkwON723oH+Tcwt8a23:792dvVaYeb8EFUt8O9V1/+O9X5OaYebw
MD5:	91848343C6FF5F7AD62332D6C666583A
SHA1:	40073E208FD626A9B11E216BE3C7B73361CA674D
SHA-256:	C00237822B8918C771C50243BD2D4DF343C687C7628E2796B2B43D5B206E43E5
SHA-512:	890F89370ADA8D762A6AF43EDFC229581C73C3E2FD47E123C49321474BC9474AD8E28C428B5082DE8645A88A30845B2642948CC8242EF7016175A7A59C34349D
Malicious:	false
Preview:	2024/12/18-04:58:17.809 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/18-04:58:17.865 1c98 Recovering log #3.2024/12/18-04:58:17.870 1c98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\00e14a43-e741-4d74-a43b-27632231fd35.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF36ca5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a7955107-657c-4d5f-8416-ab8dddc39075.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	242
Entropy (8bit):	4.388354857261946
Encrypted:	false
SSDEEP:	6:S85aEFljljljljlKCZtllaV939V/N8JEHBdUV:S+a8ljljljljlKCTlc9T8ihW
MD5:	0658F9AF563737EE080F3BF5B9557E7C
SHA1:	341C0C67FB1A9D92021329133536CBDD424A72F6
SHA-256:	93FF1C1004550A4EB0C0D934402CF71114710472BF43D427DFEFA2B98326C9A3
SHA-512:	F9F5E1A830DFA954684B41373C12DD95B61F1E70C231224132C508608D4BCE4EEECB9BD407607694F4AA7F6C14B9D53E8D5D541B5044B33D3B142F698C668B4D
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............>...b................next-map-id.1.Cnamespace-230a724c_6de1_4910_a0ab_f6165109285b-https://ntp.msn.com/.0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.160297704811024
Encrypted:	false
SSDEEP:	6:7cLV1FlL+q2PN723oH+TcwtrQMxIFUt8OcLVz11Zmw+OcLVf0HlLVkwON723oH+L:7+FIvVaYebCFUt8OG1/+ONz5OaYebtJ
MD5:	BEE5302BFB18A88F6E29A5CE87F65897
SHA1:	6F2C8B2D7E60B8ED93F834887C7BC7F59B8318F1
SHA-256:	277861CEEF82B4D64267059BEBF09C60C890D5DC19922508FDA1277A6B46DE25
SHA-512:	70C82618D1F4078E2D1D1F73BED6923B4F147440531B19195C14A1DF64BBE8E3B983D6B3E9F42E5CA82CA383E7D00EC636FE25BB29E4B8FC0F128D608FE5F949
Malicious:	false
Preview:	2024/12/18-04:58:18.063 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/18-04:58:18.069 1c98 Recovering log #3.2024/12/18-04:58:18.073 1c98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.160297704811024
Encrypted:	false
SSDEEP:	6:7cLV1FlL+q2PN723oH+TcwtrQMxIFUt8OcLVz11Zmw+OcLVf0HlLVkwON723oH+L:7+FIvVaYebCFUt8OG1/+ONz5OaYebtJ
MD5:	BEE5302BFB18A88F6E29A5CE87F65897
SHA1:	6F2C8B2D7E60B8ED93F834887C7BC7F59B8318F1
SHA-256:	277861CEEF82B4D64267059BEBF09C60C890D5DC19922508FDA1277A6B46DE25
SHA-512:	70C82618D1F4078E2D1D1F73BED6923B4F147440531B19195C14A1DF64BBE8E3B983D6B3E9F42E5CA82CA383E7D00EC636FE25BB29E4B8FC0F128D608FE5F949
Malicious:	false
Preview:	2024/12/18-04:58:18.063 1c98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/18-04:58:18.069 1c98 Recovering log #3.2024/12/18-04:58:18.073 1c98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13378989499701294

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1296
Entropy (8bit):	3.6463314508768576
Encrypted:	false
SSDEEP:	24:3GNeddpnbzUjpsAF4unxktLp3X2amEtG1ChqqL5E2l9QKkOAM4q:35nbzuzFCLp2FEkChp9E2leHOp
MD5:	E3280EC2B74B7F27B5730C0C498AA7A3
SHA1:	1EBC5622952E739432A2187E5810A582E62A3388
SHA-256:	DB8D9A33441F4D2EE6E5BF29B50B36B9726C0B688B58E6F796331151B8A46479
SHA-512:	871E1990B1E7E36B6284B51A51DB6C1CF6355BB01D756553D6098D4DA7FA0D4A52FE662D47333A0852EECA1498758FBA13CF54F3B90A9776033469B34B7F59C4
Malicious:	false
Preview:	SNSS.........S4.............S4......"..S4.............S4.........S4.........S4.........S4....!....S4.................................S4..S41..,.....S4$...230a724c_6de1_4910_a0ab_f6165109285b.....S4.........S4.................S4........S4.............S4........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........(t.)...(t.).................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8....................................................................... .......................................................P...$...8.5.f.e.8.4.2.9.-.0.0.3.3.-.4.a.1.5.-.a.e.d.1.-.2.9.a.1.f.a.1.f.b.a.9.3.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.1707140434941685
Encrypted:	false
SSDEEP:	6:7EN+q2PN723oH+Tcwt7Uh2ghZIFUt8ORUpWZmw+OVUVkwON723oH+Tcwt7Uh2gnd:7EN+vVaYebIhHh2FUt8ORl/+OVUV5Oa0
MD5:	84132B823643E81F33DA99B212AAE435
SHA1:	96276CC3DFC21453A256F1DE4F9773A9ACDC518A
SHA-256:	84E6A344D4AF3A18F82D76C8ADCCC0B8A4974CD6CAD257F6D8530B07A03D0174
SHA-512:	21C5C4042BA7AB0925C72977BB98B619DB2E08564CEF405F87E135650B12ADB3965A43F63ED0157F554C6798A1175D45F6FAF4BA47591055904B3C1E6F1CDCD2
Malicious:	false
Preview:	2024/12/18-04:58:17.366 160c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/18-04:58:17.367 160c Recovering log #3.2024/12/18-04:58:17.368 160c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.1707140434941685
Encrypted:	false
SSDEEP:	6:7EN+q2PN723oH+Tcwt7Uh2ghZIFUt8ORUpWZmw+OVUVkwON723oH+Tcwt7Uh2gnd:7EN+vVaYebIhHh2FUt8ORl/+OVUV5Oa0
MD5:	84132B823643E81F33DA99B212AAE435
SHA1:	96276CC3DFC21453A256F1DE4F9773A9ACDC518A
SHA-256:	84E6A344D4AF3A18F82D76C8ADCCC0B8A4974CD6CAD257F6D8530B07A03D0174
SHA-512:	21C5C4042BA7AB0925C72977BB98B619DB2E08564CEF405F87E135650B12ADB3965A43F63ED0157F554C6798A1175D45F6FAF4BA47591055904B3C1E6F1CDCD2
Malicious:	false
Preview:	2024/12/18-04:58:17.366 160c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/18-04:58:17.367 160c Recovering log #3.2024/12/18-04:58:17.368 160c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.225080752543996
Encrypted:	false
SSDEEP:	12:7KK+vVaYebvqBQFUt8OZ/+OfV5OaYebvqBvJ:74VaYebvZg8ONfOaYebvk
MD5:	E043F099FCD9A1BB594E3156D30AFDCE
SHA1:	75C7D4E5CF635BCB23634A2A58DC4F21F0231A20
SHA-256:	95E2CB7A6C187930737106EDAFC7F14B250A9222EF4DEB644342B840728DC0DF
SHA-512:	4CCA80D9101705A97DBE9F3A62103CD4A32A4E4E33DF0CF652FFD22A611016AC5792C0C43A11BCE81BC7AC8051B46AF427019A70DA94BBE6FD2269CC98E2D33F
Malicious:	false
Preview:	2024/12/18-04:58:18.079 1cbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/18-04:58:18.091 1cbc Recovering log #3.2024/12/18-04:58:18.093 1cbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.225080752543996
Encrypted:	false
SSDEEP:	12:7KK+vVaYebvqBQFUt8OZ/+OfV5OaYebvqBvJ:74VaYebvZg8ONfOaYebvk
MD5:	E043F099FCD9A1BB594E3156D30AFDCE
SHA1:	75C7D4E5CF635BCB23634A2A58DC4F21F0231A20
SHA-256:	95E2CB7A6C187930737106EDAFC7F14B250A9222EF4DEB644342B840728DC0DF
SHA-512:	4CCA80D9101705A97DBE9F3A62103CD4A32A4E4E33DF0CF652FFD22A611016AC5792C0C43A11BCE81BC7AC8051B46AF427019A70DA94BBE6FD2269CC98E2D33F
Malicious:	false
Preview:	2024/12/18-04:58:18.079 1cbc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/18-04:58:18.091 1cbc Recovering log #3.2024/12/18-04:58:18.093 1cbc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\56af2f08-06ae-4b52-9f86-02c1357061a4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.200281969639834
Encrypted:	false
SSDEEP:	6:7313Vq2PN723oH+TcwtpIFUt8O313gZmw+O313IkwON723oH+Tcwta/WLJ:7l3VvVaYebmFUt8Ol3g/+Ol3I5OaYeb7
MD5:	7DABD675535DB22D01876ED91966426A
SHA1:	48FEC6BD7F6FDD1B4417F8037840BEAC9767CF0A
SHA-256:	4DC78CEA015674CC97A1D5C3764A39D4A36FA88C94BCEC6E50417855071EFCC3
SHA-512:	EA364A69A742F81CB5C0CA5118520C6C41A402DDF7B3494D8D3EB7FB1F7EFC48FEEFAD16A04FB1AA17E4B058AE15586DCE3401DE3F936FF10FB8B6C794CB5640
Malicious:	false
Preview:	2024/12/18-04:58:17.250 16e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/18-04:58:17.250 16e4 Recovering log #3.2024/12/18-04:58:17.250 16e4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.200281969639834
Encrypted:	false
SSDEEP:	6:7313Vq2PN723oH+TcwtpIFUt8O313gZmw+O313IkwON723oH+Tcwta/WLJ:7l3VvVaYebmFUt8Ol3g/+Ol3I5OaYeb7
MD5:	7DABD675535DB22D01876ED91966426A
SHA1:	48FEC6BD7F6FDD1B4417F8037840BEAC9767CF0A
SHA-256:	4DC78CEA015674CC97A1D5C3764A39D4A36FA88C94BCEC6E50417855071EFCC3
SHA-512:	EA364A69A742F81CB5C0CA5118520C6C41A402DDF7B3494D8D3EB7FB1F7EFC48FEEFAD16A04FB1AA17E4B058AE15586DCE3401DE3F936FF10FB8B6C794CB5640
Malicious:	false
Preview:	2024/12/18-04:58:17.250 16e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/18-04:58:17.250 16e4 Recovering log #3.2024/12/18-04:58:17.250 16e4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2678210266871826
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMQSA1LyKOMq+8iP5GDHP/0jMVum0:Kq+n0JQ91LyKOMq+8iP5GLP/01
MD5:	C2FDAB60D7809E3CACF298082564988F
SHA1:	D0CD7A2EC0FCAB67AFCE9F7342C2227EFA614EDE
SHA-256:	14028AD6E52D8E7A56DD5E5F12C2E2DABC20232285824B0D36355C009E12BA4A
SHA-512:	33583ECF477C51B84426A7087167DB051EE4DC17A0D0A770C42EE315FB0B701AB8A599DC4E75B8D475450266BD4317B8C2120F4D0E29A6FCA39997F7DCE34286
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d20ba860-011c-4d92-b16d-cf758ed38a5f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.054145434380592196
Encrypted:	false
SSDEEP:	6:GtStutU/H1tStutU/H1R9XCChslotGLNl0ml/Vl/XoQXEl:MtU/ZtU/VLpEjVl/PvoQ
MD5:	23D5196D57E5C6CC3936976033FD7B41
SHA1:	B18F250B8321F487FE01C49D2EEDA502654C6FAB
SHA-256:	34F4F9B3EE9B5380C4137C077EFA99E8CAB8C2822F21017A2D0338577D5E7D3A
SHA-512:	744C315DD38AF1EFD8E7700E80ECAE413EA60FED0087FB00ED4FFCF4F24F354F76700C8F5B290DCBEF304AAFED1E7B8895DF344473EDF5C8E6A442F4BD214C1D
Malicious:	false
Preview:	..-.....................rKDy...$J...V...H..xB$..-.....................rKDy...$J...V...H..xB$........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	86552
Entropy (8bit):	0.8705891541689245
Encrypted:	false
SSDEEP:	48:eqzxjlO+H1qcbX+En9VAKAFXX+pRw2VAKAFXX+6xOqVAKAFXX+GnUYVAKAFXX+aF:e6xLV0xNs/cNswO5NshNsaF
MD5:	5144D0870708018E56F8F0CA9ED9809B
SHA1:	9A825A96460AB5F6F8BBF4B92267000EB0C32DCD
SHA-256:	742846846397E5EC405B01572912CDCCFCF49C273A3AB5EB3A6CCF5B3FEE928A
SHA-512:	FD89F93A1B24E6EBE5FA8AAAE5D5E74C1BA9B6498959E7D2748D41A5E80871E2AAE1F7F2868DB28736BC41C272B9C1FB21A91CCB3895AF44A4106E70CC53718D
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.261134334480461
Encrypted:	false
SSDEEP:	6:7YI+q2PN723oH+TcwtfrK+IFUt8OzWZmw+OGVkwON723oH+TcwtfrUeLJ:7YI+vVaYeb23FUt8Oq/+OGV5OaYeb3J
MD5:	B3B207E6119C548D7398576CC0CD716C
SHA1:	67E0176E19E6BB9C467870E0775768C3EF3A84F7
SHA-256:	18611C91DA6F0EC0A8965A97953CD6E7E3FCBB04712AF242D939F9B73B7330B3
SHA-512:	9EBAE7E925280607AB485B6E834F385F5C1BCB9567B19AD92A0D814417E36FD727E969165584907D5397429CEBF6A2A01C28E042A2B38C16CA2699896C12DEA9
Malicious:	false
Preview:	2024/12/18-04:58:17.987 160c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/18-04:58:17.988 160c Recovering log #3.2024/12/18-04:58:17.988 160c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.261134334480461
Encrypted:	false
SSDEEP:	6:7YI+q2PN723oH+TcwtfrK+IFUt8OzWZmw+OGVkwON723oH+TcwtfrUeLJ:7YI+vVaYeb23FUt8Oq/+OGV5OaYeb3J
MD5:	B3B207E6119C548D7398576CC0CD716C
SHA1:	67E0176E19E6BB9C467870E0775768C3EF3A84F7
SHA-256:	18611C91DA6F0EC0A8965A97953CD6E7E3FCBB04712AF242D939F9B73B7330B3
SHA-512:	9EBAE7E925280607AB485B6E834F385F5C1BCB9567B19AD92A0D814417E36FD727E969165584907D5397429CEBF6A2A01C28E042A2B38C16CA2699896C12DEA9
Malicious:	false
Preview:	2024/12/18-04:58:17.987 160c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/18-04:58:17.988 160c Recovering log #3.2024/12/18-04:58:17.988 160c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.24779723452166
Encrypted:	false
SSDEEP:	6:7SI+q2PN723oH+TcwtfrzAdIFUt8O5WZmw+OfVkwON723oH+TcwtfrzILJ:7h+vVaYeb9FUt8Ok/+OfV5OaYeb2J
MD5:	9B8ADDA6E06C4FC28FFC31E27369EBFB
SHA1:	01ADCFADC5E193A9D0CFAD9627FF14C01F82A070
SHA-256:	5414758C824CF0B3FAD9F4B00E685A5E3AFC45577CB0FDC5F1FF321899CBB5F0
SHA-512:	700727BCEB8B6672278C7A27743765B0CBC41C9EB97C12CB893B6DCC68338269F59A87306931136221EAA2A488B81C886993356842E9C41ED2D26314664DD3EA
Malicious:	false
Preview:	2024/12/18-04:58:17.981 160c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/18-04:58:17.982 160c Recovering log #3.2024/12/18-04:58:17.983 160c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.24779723452166
Encrypted:	false
SSDEEP:	6:7SI+q2PN723oH+TcwtfrzAdIFUt8O5WZmw+OfVkwON723oH+TcwtfrzILJ:7h+vVaYeb9FUt8Ok/+OfV5OaYeb2J
MD5:	9B8ADDA6E06C4FC28FFC31E27369EBFB
SHA1:	01ADCFADC5E193A9D0CFAD9627FF14C01F82A070
SHA-256:	5414758C824CF0B3FAD9F4B00E685A5E3AFC45577CB0FDC5F1FF321899CBB5F0
SHA-512:	700727BCEB8B6672278C7A27743765B0CBC41C9EB97C12CB893B6DCC68338269F59A87306931136221EAA2A488B81C886993356842E9C41ED2D26314664DD3EA
Malicious:	false
Preview:	2024/12/18-04:58:17.981 160c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/18-04:58:17.982 160c Recovering log #3.2024/12/18-04:58:17.983 160c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089810106845964
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPMxkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn9+kzItSmd6qE7lFoC
MD5:	C946A052DD3C2A4A9A6995CB74B22DB5
SHA1:	C24769DD3365457D3744AC1EDC993CF3441FCDEB
SHA-256:	BF79052EFA373324BDF267792D03B4AD6715470CD65DD378DAF2236E4D9E0554
SHA-512:	55B2EDAEBB676999A8433EB52AC77421BAA098D8B8D27FD30E6623894D3B0567F02721FC4D675F9C8FEC72D86C9027AEAB67058BE1C9824616D737F2B78A3672
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3565e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089810106845964
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPMxkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn9+kzItSmd6qE7lFoC
MD5:	C946A052DD3C2A4A9A6995CB74B22DB5
SHA1:	C24769DD3365457D3744AC1EDC993CF3441FCDEB
SHA-256:	BF79052EFA373324BDF267792D03B4AD6715470CD65DD378DAF2236E4D9E0554
SHA-512:	55B2EDAEBB676999A8433EB52AC77421BAA098D8B8D27FD30E6623894D3B0567F02721FC4D675F9C8FEC72D86C9027AEAB67058BE1C9824616D737F2B78A3672
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3567e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089810106845964
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPMxkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn9+kzItSmd6qE7lFoC
MD5:	C946A052DD3C2A4A9A6995CB74B22DB5
SHA1:	C24769DD3365457D3744AC1EDC993CF3441FCDEB
SHA-256:	BF79052EFA373324BDF267792D03B4AD6715470CD65DD378DAF2236E4D9E0554
SHA-512:	55B2EDAEBB676999A8433EB52AC77421BAA098D8B8D27FD30E6623894D3B0567F02721FC4D675F9C8FEC72D86C9027AEAB67058BE1C9824616D737F2B78A3672
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35852.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089810106845964
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPMxkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn9+kzItSmd6qE7lFoC
MD5:	C946A052DD3C2A4A9A6995CB74B22DB5
SHA1:	C24769DD3365457D3744AC1EDC993CF3441FCDEB
SHA-256:	BF79052EFA373324BDF267792D03B4AD6715470CD65DD378DAF2236E4D9E0554
SHA-512:	55B2EDAEBB676999A8433EB52AC77421BAA098D8B8D27FD30E6623894D3B0567F02721FC4D675F9C8FEC72D86C9027AEAB67058BE1C9824616D737F2B78A3672
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.011905112959427
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclRYKc4Y:YWLSGTt1o9LuLgfGBPAzkVj/T8le7
MD5:	05ACC30CD19907D1CC74F6F58611240D
SHA1:	FD06C3FF681D9940F56203B7A73F6B75E89368F0
SHA-256:	2548BEF7C88CD217BC798E3C152FBF79154CB16FE2ACC215E173ED12B8CC1A7C
SHA-512:	AD2AFDB7BECF560EE2B5B12B7A571015CCA01BD30A6CD430CB9448BDE39A1E24E8A3FE49CEA87485FB25163622515A51906496CF1DE149C495288756D63C4F85
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1734616702607490}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a8ba0c4b-6e77-4a4f-90eb-f1b21167b222.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44922
Entropy (8bit):	6.094587040760675
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJsi1zNt7crNknY1+p/AQKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yniE0KtSmd6qE7lFoC
MD5:	7F31E7748F8BCFE03D4971969CDD0CDC
SHA1:	D7873EA7F5F66FD1EFCD55D65524CDD8E13EB248
SHA-256:	BFF046549666904F47D84083753FFB19C41BBC270B8A1F0125A9547CAEF0F20C
SHA-512:	DB18CA3575F09B256F8761BE14F29A3C9A863B350664E5ECFDC278B88D7394FAC5601BF825C3F83C3D5676AC4494EC11AA7C68AEA11F22680E1A77C5EEDD7B03
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\bd0dadb4-d3e2-4cf4-bebd-c2d54f8d3824.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089810106845964
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPMxkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn9+kzItSmd6qE7lFoC
MD5:	C946A052DD3C2A4A9A6995CB74B22DB5
SHA1:	C24769DD3365457D3744AC1EDC993CF3441FCDEB
SHA-256:	BF79052EFA373324BDF267792D03B4AD6715470CD65DD378DAF2236E4D9E0554
SHA-512:	55B2EDAEBB676999A8433EB52AC77421BAA098D8B8D27FD30E6623894D3B0567F02721FC4D675F9C8FEC72D86C9027AEAB67058BE1C9824616D737F2B78A3672
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8530079385898923
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx+xl9Il8udpdpQ80CadA5ZYx+8ts1vQCd1rc:mvYr6801my0Qh
MD5:	1CA9DF4A06BA4D6D56277736BDF08D5B
SHA1:	043A9C4703F13F54AD1860F377732C41B8884094
SHA-256:	215309F757213E0501FC3BDC1EBF54D4819C7535CFABFB592B3A3103B9F6BC15
SHA-512:	FA1EFF62754F202043D428EE2DBE3C322EB2CEE96865F683A35B574E53C11B68AEDB14191554CCCCA8E004ECC0F32B6682DA2FBC3A6BAD4E23CF97C7309CED0D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.J.v.4.w.D.t.R.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.N.p.F.L.5.D.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.004397320023935
Encrypted:	false
SSDEEP:	96:JYr2F3c3nnqFtY+iV0OR5pMq25Kc/GL4uw:Jm2FSnqF2Vuq0AL7w
MD5:	B6D3A82480AB11AD146050C4E8BE090D
SHA1:	4166E48EC82C5F12BFD54DD96E02C550F480445C
SHA-256:	191B7CEB5198B90434653E96B36DF8C7F0F230B4EB29970984E0D165E7EBA9F6
SHA-512:	5C1F6AB2CE4DB45FE5627299248DF20B5A889660A247D570F9546CBE109ABE59A6AEE17FCBBBDED08BDFC581C74B453AC956F583E9ECBB1418B7C28A5FABFA1D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Z.y.E.c.p.z.N.R.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.N.p.F.L.5.D.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9037492574694745
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xAxl9Il8udpdpnVUQJ0bcSdulN1ikeq0j3ohtetmhjH04DyU5z8W:aCYrJJ0ZdqVmshcoho4DyU5z8W
MD5:	B1A8B15A3219F9C39C5A8CF9D3AA57FA
SHA1:	DBEAC9B604375518E64CDB0F2C8DFAA004086202
SHA-256:	EA99C2CFD483111D9FE9F28B93A894746B4279B1D2E50B1E17E6ECC1DA708612
SHA-512:	734AEB7E56DBB1E0DB6C426163FD73207FA88A238A723E48DB684E09D37834D870B3F276F11702FAC85F2831B9186C944354F50C0667488F5A45553F0C22D40A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".7.r./.X.1.g.R.w.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.N.p.F.L.5.D.

C:\Users\user\AppData\Local\Microsoft\edgecookies.txt

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	540
Entropy (8bit):	5.210618767812939
Encrypted:	false
SSDEEP:	12:379gj796LP79Bf1XmOc4rj9Z79im+79dy/9bVGGn9l:RQ6BNXa4fitqxV9l
MD5:	C9242A2A653E5A074E89F41B831907E3
SHA1:	611DD4E105B285E96ED682C8B0F4E09DBDE57698
SHA-256:	83711207BBC0400269C8EFC027489C3B7110AA79FC648B39F6ADC4276983AF7E
SHA-512:	9B56B6BC1354EB7A55FD2F2D75DACBE1A4125596AF1B18C100DF29DFD097A9B4967CAF3D1C18B250ACB2D37FB370A8BE75864D2F8E6D447B3DEE676071AA18B1
Malicious:	false
Preview:	ntp.msn.com.TRUE./.FALSE.2597573456._C_Auth...msn.com.TRUE./.FALSE.2597573456._C_ETH.1.ntp.msn.com.TRUE./.FALSE.2597573456.sptmarket.en-GB\|\|us\|en-us\|en-us\|en\|\|cf=8\|RefA=DAD4FD1CC31344ACAB9A2BB7C9B56378.RefC=2024-12-18T09:58:21Z..msn.com.TRUE./.FALSE.2597573456.USRLOC...msn.com.TRUE./.FALSE.2597573456.MUID.1B0CEF78A0896BA91FF5FA21A1906AF8.ntp.msn.com.TRUE./.FALSE.2597573456.MUIDB.1B0CEF78A0896BA91FF5FA21A1906AF8..msn.com.TRUE./.FALSE.2597573456._EDGE_S.F=1&SID=04AC7D5CB4776A312DB26805B5DF6B9F..msn.com.TRUE./.FALSE.2597573456._EDGE_V.1.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1420
Entropy (8bit):	5.410025257288925
Encrypted:	false
SSDEEP:	24:YZGMfJVA/5BGMLfp5BGMz6jT07ncIF5InHI0MY5kUQnA0OpJ5xHRS4L0Mom2J5VJ:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2AO
MD5:	B0FA6601039170CC9691339292D185FB
SHA1:	056BB89B5091BBA0C70BEDC983A7A6AF1404FCEB
SHA-256:	076BA006026E2D284313C1479B347A1E4BB9AEF066F38B449F3DD3F0D24B1EE2
SHA-512:	B1B1206844128324D4FD0BE89D6CB0AC6B82A73A7FEFC6EE1DF47062A4D4ADF630EB9B8BD87B81544B9F6A7AC6C3FE0F8204F8E04292C5E663747ECFEB67D045
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\edge_tempfile.db

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2678210266871826
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMQSA1LyKOMq+8iP5GDHP/0jMVum0:Kq+n0JQ91LyKOMq+8iP5GLP/01
MD5:	C2FDAB60D7809E3CACF298082564988F
SHA1:	D0CD7A2EC0FCAB67AFCE9F7342C2227EFA614EDE
SHA-256:	14028AD6E52D8E7A56DD5E5F12C2E2DABC20232285824B0D36355C009E12BA4A
SHA-512:	33583ECF477C51B84426A7087167DB051EE4DC17A0D0A770C42EE315FB0B701AB8A599DC4E75B8D475450266BD4317B8C2120F4D0E29A6FCA39997F7DCE34286
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fd7d9f9d-1f8e-4f53-b27c-ba2dc346e737.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	31335
Entropy (8bit):	7.694019108205432
Encrypted:	false
SSDEEP:	768:514ugFV0910SWyR5kNVdS3sNp/xm3MbiMuYEDlyFUyv6E/ty8:5WcDWyRKNVd2M/IxMuYEDlymsTQ8
MD5:	6B72597205C77D3E40E1A35BEE403801
SHA1:	6BECEE055C6E057AF9475B6D651B4EE561D02F20
SHA-256:	C899297FBDFC88C1634B1145A087FDB5BE17172FD786C078B299557B22F06DEB
SHA-512:	7CB1A98E0C7FBB349D9CB681233A9F4ED22A1C3FAADCDF1BC270B04BD97D3FC41AB6F762B2F5F231281D63D96AC3D243640BA81D5E8CCD9F54486B4F538CA8B4
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\hsperfdata_user\7076

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3134150418160835
Encrypted:	false
SSDEEP:	96:Zf6r2S8GjRijUx7UF9rVBNBXAoA+4e4SBfH/1jo1T:ZfG8GkAx7UF9rAoA5e7RH/5
MD5:	50387F7035CF71B8C6C12D33C2AEC839
SHA1:	89D4780F70AC402D0D08BD8475E078AB6101D25E
SHA-256:	C01F90095DF9C904F159EE3D9E000C54A1A85A32B9044F587FA89B15CB2898E8
SHA-512:	9220CAB0A2BD367008502DAD7BD232A5BABC1A9E4D3309990B3B2F16B04856F1065B9971B8E43ED21E07FAF6A0F4D28576CA60B0CEFA155BAFA82D5DB402AD96
Malicious:	false
Preview:	.........9........5..... .......8...........J...0...sun.rt._sync_Inflations.....0.......8...........J...0...sun.rt._sync_Deflations.....+.......@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..m.......@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..h.......8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

C:\Users\user\AppData\Local\Temp\jna-1820491375\jna5340335501256029183.dll

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	211456
Entropy (8bit):	6.575456249068181
Encrypted:	false
SSDEEP:	3072:XsYkXwU8MpSFif9jejzCvjrEt1++W9WCrHudSzoNyLXX4Fv/IK9zFaTsXvXs9G44:XFL/myjzss1++kQCo2XMLvXs9G4q2c
MD5:	E15183EF9C6C255B76FDA73D01CA7ECB
SHA1:	F816F998C43204230D9EA3EECFFB5F8372A32C2E
SHA-256:	38650A0612730C52580C9F32FF766B44B1C5A426D52E7DD7A53687BF3389AC2C
SHA-512:	EC5D7CB3A209C4A1C60BB374755F2809AE892530439FADAB335569BBBF8937DD209F9FAC27393C66371594DAEAD30545F465D25C4DB48CB519BDB50964EF756B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: stealer.jar, Detection: malicious, Browse Filename: stealer.jar, Detection: malicious, Browse Filename: t1gY0BGmOZ.jar, Detection: malicious, Browse Filename: t1gY0BGmOZ.jar, Detection: malicious, Browse Filename: bZPAo2e2Pv.jar, Detection: malicious, Browse Filename: bZPAo2e2Pv.jar, Detection: malicious, Browse Filename: soinjector.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!:..@T..@T..@T..(W..@T..(Q.S@T..(P..@T..4Q..@T..4P..@T..4W..@T..(U..@T..@U..@T..4W..@T..@T..@T..4P..@T..4T..@T..4V..@T.Rich.@T.........PE..L....}.c...........!.....N..........?R.......`............................................@.............................T...$...<....@.......................P... ..\|...................................@............`..0............................text....M.......N.................. ..`.rdata...\|...`...~...R..............@..@.data...\Q.......D..................@....rsrc........@......................@....reloc... ...P..."..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sqlite-3.20.1-2b1cbfdc-5534-4adc-ad94-dd4ff06aa3aa-sqlitejdbc.dll

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	889856
Entropy (8bit):	6.420545484819812
Encrypted:	false
SSDEEP:	24576:4h2l/NT2mP8kBDZJMa1DDGITUQYBgouZbU/OMF/0J9Jsz/p0:t7JNtDAfgNEOMF/0Jw
MD5:	5A71D86A23A6CF63244885748D3AF5B8
SHA1:	C5B4B5269B3B5A0B18E0CAB4C07CB0CB136A3AAD
SHA-256:	52A9A1CE0F110563AF4AE34B83A5C256062944CB2B294EEBB05E2568E2AE5977
SHA-512:	118D3D13D592226C4C2F873687FC15245853D1E1140406A31A46B3E60AB7AABBD6B5F2224DDD151F32A7821A48F1C1CAA481D7270E2F673B2E1FCF33A9AB688C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: stealer.jar, Detection: malicious, Browse Filename: stealer.jar, Detection: malicious, Browse Filename: t1gY0BGmOZ.jar, Detection: malicious, Browse Filename: t1gY0BGmOZ.jar, Detection: malicious, Browse Filename: bZPAo2e2Pv.jar, Detection: malicious, Browse Filename: bZPAo2e2Pv.jar, Detection: malicious, Browse Filename: soinjector.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#......................... .....e................................O......... ......................`..#....p..l................................E..................................................dr...............................text...............................`.P`.data...\|.... ......................@.p..rdata.. ....@.......*..............@.p@.bss....(....P........................p..edata..#....`.......,..............@.0@.idata..l....p.......:..............@.0..CRT....,............J..............@.0..tls.... ............L..............@.0..reloc...E.......F...N..............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempfile.db

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tempfile2.db

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\83aa4cc77f591dfc2374580bbd95f6ba_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
File Type:	data
Category:	dropped
Size (bytes):	45
Entropy (8bit):	0.9111711733157262
Encrypted:	false
SSDEEP:	3:/lwlt7n:WNn
MD5:	C8366AE350E7019AEFC9D1E6E6A498C6
SHA1:	5731D8A3E6568A5F2DFBBC87E3DB9637DF280B61
SHA-256:	11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
SHA-512:	33C980D5A638BFC791DE291EBF4B6D263B384247AB27F261A54025108F2F85374B579A026E545F81395736DD40FA4696F2163CA17640DD47F1C42BC9971B18CD
Malicious:	false
Preview:	........................................J2SE.

C:\cmdlinestart.log

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.972115967203688
Encrypted:	false
SSDEEP:	3:6JfRpDqAA/BLztvJfb8zsJOyExxNVEBAX2UApREq9vOdJfMPYrSLPOGLKIJfO+JK:4RpGAAJLLb8oxi2BAmU8E6mP6YGLPp+V
MD5:	15B6EAB37613683FC11BD46042B67007
SHA1:	F65B901C4FCB694B038DD94FCAD02A12CA62438F
SHA-256:	21A52D1E1611076F6869F99D04EE1D7193B3CF49560FC25DCF6A0427AAD15089
SHA-512:	6FB40D8C5D56E2ABAD9F7F5003F90A3972CA4A2BECC2D7B14506A337104843397DEDC3A224A27ED3E3080BC84D726E6471C3934AB6538AE4B8EAAFE92AC5C704
Malicious:	false
Preview:	SLF4J(W): No SLF4J providers were found...SLF4J(W): Defaulting to no-operation (NOP) logger implementation..SLF4J(W): See https://www.slf4j.org/codes.html#noProviders for further details...

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	165
Entropy (8bit):	4.823327254536806
Encrypted:	false
SSDEEP:	3:Vwp+EHwwBHsLpYJWriFGHTex24b7prwGWjLwWkzXFETH1u4:VwQEH5BHsL2YriFGHTLmrwGAwWeXFELN
MD5:	BA67E2CA7F04CDB1A04EB058E8FEF633
SHA1:	B690888284EE319D87E0A55AA914D3005CA8AA0F
SHA-256:	8BDFE3D214CD16C6884C386574D5D76FF9D6E23A7B7EE19949B4962FC67A732D
SHA-512:	A4F9F9317B6E13615D7D2D82881229F59AEE5EF2E4E21AA84A68503FB9CB3AA591FB361CA251D577867CE6FE63C8AB4C0F9BCB4A18837AEEF0631433BB701AAB
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",[],[],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggesteventid":5770973220762489726,"google:suggesttype":[],"google:verbatimrelevance":851}]

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1395)
Category:	downloaded
Size (bytes):	117446
Entropy (8bit):	5.490775275046353
Encrypted:	false
SSDEEP:	3072:T2yvefrtJUEgK3Cvw3wWs/ZuTZVL/G1kL:T2y4tJbDK0L/G1kL
MD5:	942EA4F96889BAE7D3C59C0724AB2208
SHA1:	033DDF473319500621D8EBB6961C4278E27222A7
SHA-256:	F59F7F32422E311462A6A6307D90CA75FE87FA11E6D481534A6F28BFCCF63B03
SHA-512:	C3F27662D08AA00ECBC910C39F6429C2F4CBC7CB5FC9083F63390047BACAF8CD7A83C3D6BBE7718F699DAE2ADA486F9E0CAED59BC3043491EECD9734EC32D92F
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);.var ca,da,ha,ma,xa,Aa,Ba;ca=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);ma=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}};.ma("Symbol",function(a){if(a)return a;var b

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132723
Entropy (8bit):	5.436853901221218
Encrypted:	false
SSDEEP:	3072:fMkJQ7O4N5dTm+syHEt4W3XdQ4Q6QuSr/nUW2i6o:fZQ7HTt/sHdQ4Q6QDfUW8o
MD5:	EEDBEC684BC2CBE8164F7350133C70C5
SHA1:	1A6C931C5715063F39631B4DC95F09FAA8EA9C4B
SHA-256:	283C0B9AFADE9E8276464388D899F17A657352B7EFCB13FABE02561DC3D00B37
SHA-512:	528B70144EBDAFC269F9DFC25862556A2E2E82EBCD8EA27A38CC729131F84D7E087138004BA7CB03FF8F1AC938C56C33BF6CCC7C435503DFE4A650424EBFE0F3
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2410)
Category:	downloaded
Size (bytes):	175897
Entropy (8bit):	5.549876394125764
Encrypted:	false
SSDEEP:	3072:t0PuJ7UV1+ApsOC3Ocr4ONnv4clQfOQMmzIWrBQoSpFMgDuq1HBGANYmYALJQIfr:t0PuJQ+ApsOOFZNnvFlqOQMmsWrBQoSd
MD5:	2368B9A3E1E7C13C00884BE7FA1F0DFC
SHA1:	8F88AD448B22177E2BDA0484648C23CA1D2AA09E
SHA-256:	577E04E2F3AB34D53B7F9D2F6DE45A4ECE86218BEC656B01DCAFF1BF6D218504
SHA-512:	105D51DE8FADDE21A134ACA185AA5C6D469B835B77BEBEC55A7E90C449F29FCC1F33DAF5D86AA98B3528722A8F533800F5146CCA600BC201712EBC9281730201
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.otmEBJ358uU.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu0yU9RTMfNNC-LVUmaaNKwIO136g"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Ui=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Vi=class extends _.Q{constructor(a){super(a)}};.}catch(e){_._DumpException(e)}.try{.var Wi,Xi,aj,dj,cj,Zi,bj;Wi=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};Xi=function(){_.Ka()};aj=function(a,b){(_.Yi\|\|(_.Yi=new Zi)).set(a,b);(_.$i\|\|(_.$i=new Zi)).set(b,a)};dj=function(a){if(bj===void 0){const b=new cj([],{});bj=Array.prototype.concat.call([],b).length===1}bj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ej=function(a,b,c){a=_.rb(a,b,c);return Array.isArray(a)?a:_.Ac};._.fj=function(a,b){a=2&b?a\|2:a&-3;return(a\|32)&-2049};_.gj=function(a,b){a===0&&(a=_.fj(a,b));return a\|1};_.hj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.ij=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.lj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ej(a,b,d);var k=h[_

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	Java archive data (JAR)
Entropy (8bit):	7.9754184157537145
TrID:	Java Archive (13504/1) 62.80% ZIP compressed archive (8000/1) 37.20%
File name:	urS3jQ9qb5.jar
File size:	14'298'253 bytes
MD5:	c61d3cf6584e6b4c19c092f55cd3c37c
SHA1:	80f4680dcbaedb8b981e27b552c458cb8baa3d13
SHA256:	0781770e55d04cd363e0da0b168cb8550db96faf6790fd7a17b216d80b0bff43
SHA512:	1d93eb4e3cfba52b67223263b8f531e057589e8627913b66c5e634f6137b1d453fd856ef6c9ed799a06a245b37eb982b7f0393b314519374d0fc3548a96aaa16
SSDEEP:	393216:CiFNtcj2Rqf0knwZbkytGTI4PE/GoJTEqUkIT6YvYTYxgs9:Ci+jkqf060o6KI4iJEqIvYTEj
TLSH:	60E61219BD8AC9AAFA9760B362C2C552E0361AEAC903D06F06E059C5DDF1E450353FFD
File Content Preview:	PK.........LrY............2...org/apache/commons/codec/language/bm/Rule$1.class/.....TmO.`.=W...l....S...(( :@e.N.1bP?..@M.6.F4..d........G......!..nI..g=......_...L.H.....:...+.]*.V....).jmT..]Y+)...>0.....,.....h.........uA.....`.j.0..M.,.......T\....7.

File Icon


Icon Hash:	d08c8e8ea2868a54

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 10:58:08.775787115 CET	443	49706	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:08.777870893 CET	49706	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:08.777951956 CET	49706	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:08.778100967 CET	49706	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:08.897806883 CET	443	49706	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:08.897828102 CET	443	49706	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:08.897840977 CET	443	49706	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:09.030483961 CET	49673	443	192.168.2.6	173.222.162.64
Dec 18, 2024 10:58:09.171163082 CET	49674	443	192.168.2.6	173.222.162.64
Dec 18, 2024 10:58:09.324044943 CET	443	49706	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:09.374267101 CET	49706	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:09.515109062 CET	443	49706	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:09.561779976 CET	49706	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:09.577555895 CET	49672	443	192.168.2.6	173.222.162.64
Dec 18, 2024 10:58:09.706398010 CET	443	49706	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:09.707926035 CET	49706	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:09.827589989 CET	443	49706	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:10.267132998 CET	443	49706	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:10.311666012 CET	49706	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:14.404881001 CET	49707	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:14.404937029 CET	443	49707	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:14.405021906 CET	49707	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:14.405888081 CET	49707	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:14.405901909 CET	443	49707	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:16.750708103 CET	443	49707	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:16.750813007 CET	49707	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:16.755248070 CET	49707	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:16.755280972 CET	443	49707	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:16.755692959 CET	443	49707	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:16.757647038 CET	49707	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:16.757802010 CET	49707	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:16.757814884 CET	443	49707	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:16.757978916 CET	49707	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:16.799367905 CET	443	49707	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:17.304258108 CET	443	49707	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:17.304389954 CET	443	49707	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:17.304450035 CET	49707	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:17.304851055 CET	49707	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:17.304883003 CET	443	49707	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:18.640465021 CET	49673	443	192.168.2.6	173.222.162.64
Dec 18, 2024 10:58:18.781096935 CET	49674	443	192.168.2.6	173.222.162.64
Dec 18, 2024 10:58:19.301892042 CET	49672	443	192.168.2.6	173.222.162.64
Dec 18, 2024 10:58:20.913772106 CET	49705	443	192.168.2.6	20.190.177.84
Dec 18, 2024 10:58:20.913849115 CET	49705	443	192.168.2.6	20.190.177.84
Dec 18, 2024 10:58:21.033356905 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:21.033379078 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:21.033390045 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:21.033397913 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:21.033504963 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:21.334670067 CET	443	49702	173.222.162.64	192.168.2.6
Dec 18, 2024 10:58:21.334800959 CET	49702	443	192.168.2.6	173.222.162.64
Dec 18, 2024 10:58:21.414124012 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:21.414412022 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:21.414465904 CET	49705	443	192.168.2.6	20.190.177.84
Dec 18, 2024 10:58:21.416649103 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:21.416827917 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:21.416873932 CET	49705	443	192.168.2.6	20.190.177.84
Dec 18, 2024 10:58:21.421581030 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:21.421652079 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:21.421713114 CET	49705	443	192.168.2.6	20.190.177.84
Dec 18, 2024 10:58:21.430021048 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:21.430085897 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:21.430134058 CET	49705	443	192.168.2.6	20.190.177.84
Dec 18, 2024 10:58:21.438487053 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:21.438585997 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:21.438632965 CET	49705	443	192.168.2.6	20.190.177.84
Dec 18, 2024 10:58:21.605431080 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:21.823394060 CET	49705	443	192.168.2.6	20.190.177.84
Dec 18, 2024 10:58:23.467669010 CET	49705	443	192.168.2.6	20.190.177.84
Dec 18, 2024 10:58:23.467850924 CET	49705	443	192.168.2.6	20.190.177.84
Dec 18, 2024 10:58:23.478312016 CET	49730	443	192.168.2.6	142.250.181.65
Dec 18, 2024 10:58:23.478410006 CET	443	49730	142.250.181.65	192.168.2.6
Dec 18, 2024 10:58:23.478498936 CET	49730	443	192.168.2.6	142.250.181.65
Dec 18, 2024 10:58:23.478729010 CET	49730	443	192.168.2.6	142.250.181.65
Dec 18, 2024 10:58:23.478770971 CET	443	49730	142.250.181.65	192.168.2.6
Dec 18, 2024 10:58:23.587229013 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:23.587424040 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:23.587460995 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:23.587496996 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:23.587534904 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:24.077414036 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:24.077450037 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:24.077507019 CET	49705	443	192.168.2.6	20.190.177.84
Dec 18, 2024 10:58:24.081501007 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:24.081711054 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:24.081758022 CET	49705	443	192.168.2.6	20.190.177.84
Dec 18, 2024 10:58:24.089871883 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:24.090106010 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:24.090204000 CET	49705	443	192.168.2.6	20.190.177.84
Dec 18, 2024 10:58:24.098320961 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:24.098402977 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:24.098449945 CET	49705	443	192.168.2.6	20.190.177.84
Dec 18, 2024 10:58:24.106781006 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:58:24.236577034 CET	49705	443	192.168.2.6	20.190.177.84
Dec 18, 2024 10:58:24.245817900 CET	49734	443	192.168.2.6	162.159.61.3
Dec 18, 2024 10:58:24.245861053 CET	443	49734	162.159.61.3	192.168.2.6
Dec 18, 2024 10:58:24.245948076 CET	49734	443	192.168.2.6	162.159.61.3
Dec 18, 2024 10:58:24.246468067 CET	49734	443	192.168.2.6	162.159.61.3
Dec 18, 2024 10:58:24.246486902 CET	443	49734	162.159.61.3	192.168.2.6
Dec 18, 2024 10:58:24.246819973 CET	49735	443	192.168.2.6	172.64.41.3
Dec 18, 2024 10:58:24.246867895 CET	443	49735	172.64.41.3	192.168.2.6
Dec 18, 2024 10:58:24.247714996 CET	49735	443	192.168.2.6	172.64.41.3
Dec 18, 2024 10:58:24.247901917 CET	49735	443	192.168.2.6	172.64.41.3
Dec 18, 2024 10:58:24.247921944 CET	443	49735	172.64.41.3	192.168.2.6
Dec 18, 2024 10:58:24.423820019 CET	49736	443	192.168.2.6	162.159.61.3
Dec 18, 2024 10:58:24.423866987 CET	443	49736	162.159.61.3	192.168.2.6
Dec 18, 2024 10:58:24.424022913 CET	49736	443	192.168.2.6	162.159.61.3
Dec 18, 2024 10:58:24.425740957 CET	49736	443	192.168.2.6	162.159.61.3
Dec 18, 2024 10:58:24.425757885 CET	443	49736	162.159.61.3	192.168.2.6
Dec 18, 2024 10:58:25.363832951 CET	443	49730	142.250.181.65	192.168.2.6
Dec 18, 2024 10:58:25.436042070 CET	49730	443	192.168.2.6	142.250.181.65
Dec 18, 2024 10:58:25.470365047 CET	443	49734	162.159.61.3	192.168.2.6
Dec 18, 2024 10:58:25.480937004 CET	443	49735	172.64.41.3	192.168.2.6
Dec 18, 2024 10:58:25.529903889 CET	49735	443	192.168.2.6	172.64.41.3
Dec 18, 2024 10:58:25.623563051 CET	49734	443	192.168.2.6	162.159.61.3
Dec 18, 2024 10:58:25.634207964 CET	443	49736	162.159.61.3	192.168.2.6
Dec 18, 2024 10:58:25.826643944 CET	49736	443	192.168.2.6	162.159.61.3
Dec 18, 2024 10:58:26.180629969 CET	49746	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:26.180676937 CET	443	49746	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:26.181550026 CET	49746	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:26.182398081 CET	49746	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:26.182410002 CET	443	49746	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:28.413170099 CET	443	49746	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:28.413254976 CET	49746	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:28.415791988 CET	49746	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:28.415811062 CET	443	49746	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:28.416182041 CET	443	49746	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:28.423182011 CET	49746	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:28.423254013 CET	49746	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:28.423263073 CET	443	49746	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:28.423448086 CET	49746	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:28.471330881 CET	443	49746	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:29.092514038 CET	443	49746	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:29.092757940 CET	443	49746	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:29.093147039 CET	49746	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:29.100894928 CET	49746	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:29.100929022 CET	443	49746	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:29.100940943 CET	49746	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:30.831331968 CET	49730	443	192.168.2.6	142.250.181.65
Dec 18, 2024 10:58:30.831361055 CET	49734	443	192.168.2.6	162.159.61.3
Dec 18, 2024 10:58:30.831434965 CET	49735	443	192.168.2.6	172.64.41.3
Dec 18, 2024 10:58:30.832087994 CET	49736	443	192.168.2.6	162.159.61.3
Dec 18, 2024 10:58:30.950547934 CET	49763	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:30.950643063 CET	443	49763	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:30.950759888 CET	49763	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:30.950983047 CET	49763	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:30.951014042 CET	443	49763	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:31.429279089 CET	49768	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:31.429332972 CET	443	49768	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:31.429416895 CET	49768	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:31.429538012 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:31.429584026 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:31.429644108 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:31.429812908 CET	49768	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:31.429831028 CET	443	49768	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:31.429984093 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:31.429995060 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:32.648425102 CET	443	49763	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:32.648902893 CET	49763	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:32.648936033 CET	443	49763	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:32.650582075 CET	443	49763	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:32.650659084 CET	49763	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:32.651849985 CET	49763	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:32.651943922 CET	443	49763	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:32.652057886 CET	49763	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:32.652070045 CET	443	49763	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:32.701541901 CET	49763	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:33.118206978 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.119921923 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:33.119925976 CET	443	49768	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.119951010 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.120126009 CET	49768	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:33.120157003 CET	443	49768	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.121634007 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.121696949 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:33.122155905 CET	443	49768	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.122215986 CET	49768	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:33.122713089 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:33.122966051 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.123230934 CET	49768	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:33.123389959 CET	443	49768	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.123544931 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:33.123553038 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.123775959 CET	49768	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:33.123788118 CET	443	49768	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.172682047 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:33.172689915 CET	49768	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:33.496875048 CET	443	49763	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.497033119 CET	443	49763	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.497194052 CET	49763	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:33.589926004 CET	49763	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:33.589967966 CET	443	49763	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.966661930 CET	443	49768	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.966893911 CET	443	49768	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.966967106 CET	49768	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:33.980139971 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.980207920 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.980247974 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.980273008 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:33.980293036 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.982213020 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:33.982233047 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.988581896 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:33.988641977 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:33.988651991 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.010108948 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.011689901 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.011713982 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.019581079 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.019656897 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.019670963 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.042706013 CET	49768	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.042730093 CET	443	49768	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.069811106 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.100270033 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.151670933 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.151700020 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.171097040 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.171153069 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.171165943 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.182621956 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.182668924 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.182681084 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.192147017 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.192200899 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.192229033 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.205909014 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.205965042 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.205981970 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.219724894 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.219779015 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.219789028 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.232433081 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.232486010 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.232496977 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.245950937 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.246016026 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.246031046 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.272484064 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.272558928 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.272571087 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.278546095 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.278614998 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.278625965 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.282499075 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.282543898 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.282555103 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.295609951 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.295658112 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.295665979 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.308664083 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.308728933 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.308738947 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.354793072 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.362513065 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.364814997 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.364861965 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.364885092 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.375483990 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.375524998 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.375541925 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.375566006 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.375607014 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.388806105 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.401299953 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.401352882 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.401377916 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.415113926 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.415165901 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.415193081 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.424706936 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.424750090 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.424762011 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.424773932 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.424812078 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.434787989 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.445801973 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.445864916 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.445875883 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.456233978 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.456284046 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.456340075 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.456348896 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.456418037 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.466942072 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.477349997 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.477453947 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.477457047 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.477471113 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.477530003 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.487863064 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.497855902 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.497905970 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.497917891 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.507016897 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.507057905 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.507064104 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.507076979 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.507117033 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.515975952 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.524427891 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.524476051 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.524486065 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.533138990 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.533191919 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.533191919 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.533216953 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.533257008 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.541629076 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.550334930 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.550384998 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.552714109 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.552737951 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.552787066 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.558861017 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.565567017 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.565623999 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.565634012 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.565650940 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.565691948 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.576277018 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.576843023 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.576890945 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.576917887 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.581262112 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.581310987 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.581320047 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.586647034 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.586693048 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.586704016 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.586714029 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.586764097 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.591947079 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.597611904 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.597676992 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.597681046 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.597692966 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.597738981 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.602991104 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.604626894 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.604674101 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.604684114 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.608704090 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.608762980 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.608771086 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.613756895 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.613815069 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.613821983 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.614669085 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:34.614723921 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.616103888 CET	49769	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:58:34.616116047 CET	443	49769	142.250.181.132	192.168.2.6
Dec 18, 2024 10:58:38.162873030 CET	49794	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:38.162925005 CET	443	49794	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:38.163219929 CET	49794	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:38.164478064 CET	49794	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:38.164494991 CET	443	49794	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:38.168015957 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:38.168066978 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:38.168210983 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:38.168495893 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:38.168509960 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:38.364417076 CET	49796	443	192.168.2.6	45.112.123.126
Dec 18, 2024 10:58:38.364451885 CET	443	49796	45.112.123.126	192.168.2.6
Dec 18, 2024 10:58:38.364617109 CET	49796	443	192.168.2.6	45.112.123.126
Dec 18, 2024 10:58:38.589494944 CET	49796	443	192.168.2.6	45.112.123.126
Dec 18, 2024 10:58:38.589509964 CET	443	49796	45.112.123.126	192.168.2.6
Dec 18, 2024 10:58:39.212301016 CET	49797	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:39.212436914 CET	443	49797	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:39.212706089 CET	49797	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:39.213182926 CET	49797	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:39.213219881 CET	443	49797	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:39.862240076 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:39.898149014 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:39.898179054 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:39.899954081 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:39.900037050 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:39.901644945 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:39.901757956 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:39.901890039 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:39.901906013 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:39.973520994 CET	443	49796	45.112.123.126	192.168.2.6
Dec 18, 2024 10:58:39.973625898 CET	49796	443	192.168.2.6	45.112.123.126
Dec 18, 2024 10:58:40.107247114 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.216384888 CET	49796	443	192.168.2.6	45.112.123.126
Dec 18, 2024 10:58:40.216407061 CET	443	49796	45.112.123.126	192.168.2.6
Dec 18, 2024 10:58:40.303057909 CET	49796	443	192.168.2.6	45.112.123.126
Dec 18, 2024 10:58:40.303062916 CET	443	49796	45.112.123.126	192.168.2.6
Dec 18, 2024 10:58:40.303632021 CET	443	49796	45.112.123.126	192.168.2.6
Dec 18, 2024 10:58:40.303694010 CET	49796	443	192.168.2.6	45.112.123.126
Dec 18, 2024 10:58:40.303843021 CET	49796	443	192.168.2.6	45.112.123.126
Dec 18, 2024 10:58:40.303855896 CET	443	49796	45.112.123.126	192.168.2.6
Dec 18, 2024 10:58:40.404126883 CET	443	49794	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:40.404227018 CET	49794	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:40.410021067 CET	49794	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:40.410077095 CET	443	49794	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:40.411133051 CET	443	49794	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:40.424926043 CET	49794	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:40.425065041 CET	49794	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:40.425077915 CET	443	49794	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:40.425164938 CET	49794	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:40.467369080 CET	443	49794	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:40.541981936 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.542052031 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.542095900 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.542108059 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.542138100 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.542154074 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.542190075 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.550327063 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.551448107 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.551481962 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.565866947 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.565922022 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.565937996 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.575558901 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.575613022 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.575627089 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.661423922 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.661474943 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.661484957 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.731801033 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.732871056 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.737833023 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.737891912 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.737907887 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.749952078 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.750006914 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.750015974 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.763670921 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.763722897 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.763731003 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.777257919 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.777404070 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.777442932 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.790858030 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.790915966 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.790925980 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.804312944 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.804367065 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.804377079 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.817151070 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.817264080 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.817301035 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.817339897 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.817401886 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.820008039 CET	49805	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:40.820050001 CET	443	49805	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:40.820193052 CET	49805	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:40.830104113 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.834156036 CET	49805	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:40.834178925 CET	443	49805	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:40.842734098 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.842789888 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.842798948 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.855623960 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.855684042 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.855696917 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.868457079 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.868516922 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.868525028 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.881196976 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.881253958 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.881262064 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.898993969 CET	443	49797	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:40.899203062 CET	49797	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:40.899266958 CET	443	49797	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:40.899807930 CET	443	49797	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:40.899873972 CET	49797	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:40.900806904 CET	443	49797	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:40.900866032 CET	49797	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:40.901752949 CET	49797	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:40.901844025 CET	443	49797	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:40.901966095 CET	49797	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:40.901989937 CET	443	49797	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:40.902025938 CET	49797	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:40.923995972 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.924061060 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.924086094 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.926662922 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.926718950 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.926733971 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.935956001 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.936016083 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.936042070 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.942131042 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.942187071 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.942195892 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.947324991 CET	443	49797	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:40.951474905 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.951529980 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.951538086 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.953721046 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.953773975 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.953780890 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.963110924 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.963165045 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.963172913 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.971837997 CET	443	49794	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:40.972068071 CET	443	49794	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:40.972142935 CET	49794	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:40.972245932 CET	49794	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:40.972278118 CET	443	49794	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:40.972496986 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.972542048 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.972548962 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.979129076 CET	49797	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:40.981086969 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.981132030 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.981137037 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.990664959 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.990712881 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.990716934 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.999816895 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:40.999866962 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:40.999871016 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.009403944 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.009455919 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:41.009459972 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.018795013 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.018841028 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:41.018846035 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.027640104 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.027681112 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:41.027684927 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.044888020 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.044943094 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:41.044954062 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.048167944 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.048238993 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:41.048260927 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.056520939 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.056576967 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:41.056596041 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.064325094 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.064372063 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:41.064378023 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.073421001 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.073470116 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:41.073479891 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.082194090 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.082238913 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:41.082247019 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.090663910 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.090709925 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:41.090718985 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.098968029 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.099009037 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:41.099015951 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.107419968 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.107461929 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:41.107466936 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.114929914 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.114986897 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:41.115003109 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.117841005 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.117906094 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:41.117922068 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.118077993 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:41.118122101 CET	443	49795	142.250.181.46	192.168.2.6
Dec 18, 2024 10:58:41.118164062 CET	49795	443	192.168.2.6	142.250.181.46
Dec 18, 2024 10:58:41.637460947 CET	443	49797	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:41.641419888 CET	443	49797	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:41.641527891 CET	49797	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:41.642467976 CET	49797	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:41.642514944 CET	443	49797	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:42.202630997 CET	443	49805	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:42.202846050 CET	49805	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:42.210187912 CET	49805	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:42.210213900 CET	443	49805	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:42.215584040 CET	49805	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:42.215591908 CET	443	49805	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:42.215822935 CET	49805	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:42.215903044 CET	443	49805	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:42.218411922 CET	49805	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:44.267275095 CET	49814	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:44.267339945 CET	443	49814	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:44.267404079 CET	49814	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:44.267669916 CET	49814	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:44.267683983 CET	443	49814	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:45.962265015 CET	443	49814	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:45.962945938 CET	49814	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:45.962973118 CET	443	49814	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:45.963572025 CET	443	49814	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:45.964080095 CET	49814	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:45.964174986 CET	443	49814	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:45.964241982 CET	49814	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:45.964241982 CET	49814	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:45.964274883 CET	443	49814	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:46.009430885 CET	49814	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:46.717523098 CET	443	49814	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:46.720974922 CET	443	49814	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:46.721029043 CET	49814	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:46.727777958 CET	49814	443	192.168.2.6	142.250.181.110
Dec 18, 2024 10:58:46.727797031 CET	443	49814	142.250.181.110	192.168.2.6
Dec 18, 2024 10:58:48.702944040 CET	49828	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:48.702989101 CET	443	49828	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:48.703079939 CET	49828	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:48.706044912 CET	49828	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:48.706065893 CET	443	49828	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:50.076283932 CET	443	49828	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:50.076371908 CET	49828	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:50.130033016 CET	49828	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:50.130100965 CET	443	49828	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:50.157497883 CET	49828	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:50.157516956 CET	443	49828	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:50.158154011 CET	443	49828	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:50.158257961 CET	49828	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:50.165246964 CET	49828	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:50.165280104 CET	443	49828	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:50.504496098 CET	49834	443	192.168.2.6	104.21.76.84
Dec 18, 2024 10:58:50.504556894 CET	443	49834	104.21.76.84	192.168.2.6
Dec 18, 2024 10:58:50.504631996 CET	49834	443	192.168.2.6	104.21.76.84
Dec 18, 2024 10:58:50.507882118 CET	49834	443	192.168.2.6	104.21.76.84
Dec 18, 2024 10:58:50.507904053 CET	443	49834	104.21.76.84	192.168.2.6
Dec 18, 2024 10:58:51.732327938 CET	443	49834	104.21.76.84	192.168.2.6
Dec 18, 2024 10:58:51.732414961 CET	49834	443	192.168.2.6	104.21.76.84
Dec 18, 2024 10:58:51.738029957 CET	49834	443	192.168.2.6	104.21.76.84
Dec 18, 2024 10:58:51.738042116 CET	443	49834	104.21.76.84	192.168.2.6
Dec 18, 2024 10:58:51.746313095 CET	49834	443	192.168.2.6	104.21.76.84
Dec 18, 2024 10:58:51.746325016 CET	443	49834	104.21.76.84	192.168.2.6
Dec 18, 2024 10:58:51.746535063 CET	443	49834	104.21.76.84	192.168.2.6
Dec 18, 2024 10:58:51.746587992 CET	49834	443	192.168.2.6	104.21.76.84
Dec 18, 2024 10:58:51.746977091 CET	49834	443	192.168.2.6	104.21.76.84
Dec 18, 2024 10:58:51.747006893 CET	443	49834	104.21.76.84	192.168.2.6
Dec 18, 2024 10:58:51.795196056 CET	49839	443	192.168.2.6	45.112.123.126
Dec 18, 2024 10:58:51.795241117 CET	443	49839	45.112.123.126	192.168.2.6
Dec 18, 2024 10:58:51.795345068 CET	49839	443	192.168.2.6	45.112.123.126
Dec 18, 2024 10:58:51.798305035 CET	49839	443	192.168.2.6	45.112.123.126
Dec 18, 2024 10:58:51.798321009 CET	443	49839	45.112.123.126	192.168.2.6
Dec 18, 2024 10:58:52.059717894 CET	49840	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:52.059766054 CET	443	49840	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:52.059875011 CET	49840	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:52.060509920 CET	49840	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:52.060535908 CET	443	49840	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:53.203243971 CET	443	49839	45.112.123.126	192.168.2.6
Dec 18, 2024 10:58:53.203351974 CET	49839	443	192.168.2.6	45.112.123.126
Dec 18, 2024 10:58:53.216877937 CET	49839	443	192.168.2.6	45.112.123.126
Dec 18, 2024 10:58:53.216914892 CET	443	49839	45.112.123.126	192.168.2.6
Dec 18, 2024 10:58:53.233309984 CET	49839	443	192.168.2.6	45.112.123.126
Dec 18, 2024 10:58:53.233329058 CET	443	49839	45.112.123.126	192.168.2.6
Dec 18, 2024 10:58:53.233772993 CET	49839	443	192.168.2.6	45.112.123.126
Dec 18, 2024 10:58:53.234006882 CET	443	49839	45.112.123.126	192.168.2.6
Dec 18, 2024 10:58:53.234090090 CET	49839	443	192.168.2.6	45.112.123.126
Dec 18, 2024 10:58:53.239712000 CET	49842	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:53.239784002 CET	443	49842	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:53.239856958 CET	49842	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:53.245666027 CET	49842	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:53.245706081 CET	443	49842	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:54.356013060 CET	443	49840	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:54.356178999 CET	49840	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:54.358128071 CET	49840	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:54.358165979 CET	443	49840	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:54.358504057 CET	443	49840	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:54.360680103 CET	49840	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:54.360928059 CET	49840	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:54.360928059 CET	49840	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:54.360946894 CET	443	49840	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:54.403342009 CET	443	49840	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:54.658348083 CET	443	49842	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:54.658520937 CET	49842	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:54.663666964 CET	49842	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:54.663700104 CET	443	49842	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:54.675141096 CET	49842	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:54.675157070 CET	443	49842	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:54.675790071 CET	443	49842	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:54.675843000 CET	49842	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:54.675853014 CET	443	49842	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:54.675878048 CET	49842	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:55.034112930 CET	443	49840	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:55.034426928 CET	443	49840	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:55.034775972 CET	49840	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:55.034775972 CET	49840	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:55.034775972 CET	49840	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:58:55.034866095 CET	443	49840	20.198.119.143	192.168.2.6
Dec 18, 2024 10:58:56.072103024 CET	49852	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:56.072150946 CET	443	49852	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:56.072252035 CET	49852	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:56.075237989 CET	49852	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:56.075268984 CET	443	49852	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:57.439075947 CET	443	49852	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:57.439158916 CET	49852	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:57.446311951 CET	49852	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:57.446333885 CET	443	49852	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:57.450212002 CET	49852	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:57.450221062 CET	443	49852	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:57.450581074 CET	443	49852	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:57.450643063 CET	49852	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:57.452403069 CET	49852	443	192.168.2.6	149.154.167.220
Dec 18, 2024 10:58:57.452420950 CET	443	49852	149.154.167.220	192.168.2.6
Dec 18, 2024 10:58:57.457226038 CET	49854	443	192.168.2.6	104.21.76.84
Dec 18, 2024 10:58:57.457273006 CET	443	49854	104.21.76.84	192.168.2.6
Dec 18, 2024 10:58:57.457345963 CET	49854	443	192.168.2.6	104.21.76.84
Dec 18, 2024 10:58:57.461488008 CET	49854	443	192.168.2.6	104.21.76.84
Dec 18, 2024 10:58:57.461508989 CET	443	49854	104.21.76.84	192.168.2.6
Dec 18, 2024 10:58:58.676836014 CET	443	49854	104.21.76.84	192.168.2.6
Dec 18, 2024 10:58:58.676923037 CET	49854	443	192.168.2.6	104.21.76.84
Dec 18, 2024 10:58:58.684087038 CET	49854	443	192.168.2.6	104.21.76.84
Dec 18, 2024 10:58:58.684103966 CET	443	49854	104.21.76.84	192.168.2.6
Dec 18, 2024 10:58:58.688868999 CET	49854	443	192.168.2.6	104.21.76.84
Dec 18, 2024 10:58:58.688878059 CET	443	49854	104.21.76.84	192.168.2.6
Dec 18, 2024 10:58:58.689305067 CET	443	49854	104.21.76.84	192.168.2.6
Dec 18, 2024 10:58:58.689369917 CET	49854	443	192.168.2.6	104.21.76.84
Dec 18, 2024 10:58:58.689383030 CET	443	49854	104.21.76.84	192.168.2.6
Dec 18, 2024 10:58:58.689392090 CET	49854	443	192.168.2.6	104.21.76.84
Dec 18, 2024 10:58:58.892399073 CET	49860	443	192.168.2.6	185.199.110.133
Dec 18, 2024 10:58:58.892442942 CET	443	49860	185.199.110.133	192.168.2.6
Dec 18, 2024 10:58:58.892683983 CET	49860	443	192.168.2.6	185.199.110.133
Dec 18, 2024 10:58:58.896611929 CET	49860	443	192.168.2.6	185.199.110.133
Dec 18, 2024 10:58:58.896636963 CET	443	49860	185.199.110.133	192.168.2.6
Dec 18, 2024 10:59:00.106014967 CET	443	49860	185.199.110.133	192.168.2.6
Dec 18, 2024 10:59:00.106287003 CET	49860	443	192.168.2.6	185.199.110.133
Dec 18, 2024 10:59:00.121119022 CET	49860	443	192.168.2.6	185.199.110.133
Dec 18, 2024 10:59:00.121140003 CET	443	49860	185.199.110.133	192.168.2.6
Dec 18, 2024 10:59:00.125916004 CET	49860	443	192.168.2.6	185.199.110.133
Dec 18, 2024 10:59:00.125942945 CET	443	49860	185.199.110.133	192.168.2.6
Dec 18, 2024 10:59:00.126528025 CET	443	49860	185.199.110.133	192.168.2.6
Dec 18, 2024 10:59:00.126643896 CET	49860	443	192.168.2.6	185.199.110.133
Dec 18, 2024 10:59:00.126656055 CET	443	49860	185.199.110.133	192.168.2.6
Dec 18, 2024 10:59:00.126765966 CET	49860	443	192.168.2.6	185.199.110.133
Dec 18, 2024 10:59:02.047703028 CET	80	49703	217.20.58.100	192.168.2.6
Dec 18, 2024 10:59:02.047868967 CET	49703	80	192.168.2.6	217.20.58.100
Dec 18, 2024 10:59:02.090167046 CET	49703	80	192.168.2.6	217.20.58.100
Dec 18, 2024 10:59:02.209664106 CET	80	49703	217.20.58.100	192.168.2.6
Dec 18, 2024 10:59:12.205341101 CET	49892	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:59:12.205388069 CET	443	49892	20.198.119.143	192.168.2.6
Dec 18, 2024 10:59:12.205486059 CET	49892	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:59:12.206085920 CET	49892	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:59:12.206099987 CET	443	49892	20.198.119.143	192.168.2.6
Dec 18, 2024 10:59:14.409934998 CET	443	49892	20.198.119.143	192.168.2.6
Dec 18, 2024 10:59:14.410012007 CET	49892	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:59:14.412107944 CET	49892	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:59:14.412115097 CET	443	49892	20.198.119.143	192.168.2.6
Dec 18, 2024 10:59:14.412365913 CET	443	49892	20.198.119.143	192.168.2.6
Dec 18, 2024 10:59:14.413933992 CET	49892	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:59:14.413994074 CET	49892	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:59:14.413997889 CET	443	49892	20.198.119.143	192.168.2.6
Dec 18, 2024 10:59:14.414283037 CET	49892	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:59:14.459331989 CET	443	49892	20.198.119.143	192.168.2.6
Dec 18, 2024 10:59:14.954523087 CET	443	49892	20.198.119.143	192.168.2.6
Dec 18, 2024 10:59:14.954776049 CET	443	49892	20.198.119.143	192.168.2.6
Dec 18, 2024 10:59:14.954862118 CET	49892	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:59:14.954977036 CET	49892	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:59:14.955018997 CET	443	49892	20.198.119.143	192.168.2.6
Dec 18, 2024 10:59:33.437084913 CET	49941	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:59:33.437134027 CET	443	49941	142.250.181.132	192.168.2.6
Dec 18, 2024 10:59:33.437243938 CET	49941	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:59:33.437570095 CET	49941	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:59:33.437596083 CET	443	49941	142.250.181.132	192.168.2.6
Dec 18, 2024 10:59:35.123013020 CET	443	49941	142.250.181.132	192.168.2.6
Dec 18, 2024 10:59:35.123420954 CET	49941	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:59:35.123435974 CET	443	49941	142.250.181.132	192.168.2.6
Dec 18, 2024 10:59:35.124027014 CET	443	49941	142.250.181.132	192.168.2.6
Dec 18, 2024 10:59:35.124599934 CET	49941	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:59:35.124670029 CET	443	49941	142.250.181.132	192.168.2.6
Dec 18, 2024 10:59:35.178823948 CET	49941	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:59:38.119380951 CET	49955	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:59:38.119422913 CET	443	49955	20.198.119.143	192.168.2.6
Dec 18, 2024 10:59:38.119497061 CET	49955	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:59:38.120109081 CET	49955	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:59:38.120124102 CET	443	49955	20.198.119.143	192.168.2.6
Dec 18, 2024 10:59:40.330590963 CET	443	49955	20.198.119.143	192.168.2.6
Dec 18, 2024 10:59:40.330701113 CET	49955	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:59:40.411892891 CET	49955	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:59:40.411926985 CET	443	49955	20.198.119.143	192.168.2.6
Dec 18, 2024 10:59:40.412812948 CET	443	49955	20.198.119.143	192.168.2.6
Dec 18, 2024 10:59:40.453674078 CET	49955	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:59:40.454070091 CET	49955	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:59:40.454077959 CET	443	49955	20.198.119.143	192.168.2.6
Dec 18, 2024 10:59:40.454366922 CET	49955	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:59:40.499325991 CET	443	49955	20.198.119.143	192.168.2.6
Dec 18, 2024 10:59:41.113787889 CET	443	49955	20.198.119.143	192.168.2.6
Dec 18, 2024 10:59:41.114008904 CET	443	49955	20.198.119.143	192.168.2.6
Dec 18, 2024 10:59:41.114073992 CET	49955	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:59:41.114203930 CET	49955	443	192.168.2.6	20.198.119.143
Dec 18, 2024 10:59:41.114223003 CET	443	49955	20.198.119.143	192.168.2.6
Dec 18, 2024 10:59:44.833288908 CET	443	49941	142.250.181.132	192.168.2.6
Dec 18, 2024 10:59:44.833348989 CET	443	49941	142.250.181.132	192.168.2.6
Dec 18, 2024 10:59:44.833479881 CET	49941	443	192.168.2.6	142.250.181.132
Dec 18, 2024 10:59:48.985903978 CET	49701	443	192.168.2.6	20.190.177.84
Dec 18, 2024 10:59:49.106774092 CET	443	49701	20.190.177.84	192.168.2.6
Dec 18, 2024 10:59:49.106837988 CET	49701	443	192.168.2.6	20.190.177.84
Dec 18, 2024 10:59:55.668118954 CET	49705	443	192.168.2.6	20.190.177.84
Dec 18, 2024 10:59:55.788058996 CET	443	49705	20.190.177.84	192.168.2.6
Dec 18, 2024 10:59:55.788170099 CET	49705	443	192.168.2.6	20.190.177.84
Dec 18, 2024 11:00:00.939410925 CET	49941	443	192.168.2.6	142.250.181.132
Dec 18, 2024 11:00:00.939436913 CET	443	49941	142.250.181.132	192.168.2.6
Dec 18, 2024 11:00:06.456091881 CET	50018	443	192.168.2.6	20.198.119.143
Dec 18, 2024 11:00:06.456141949 CET	443	50018	20.198.119.143	192.168.2.6
Dec 18, 2024 11:00:06.456243038 CET	50018	443	192.168.2.6	20.198.119.143
Dec 18, 2024 11:00:06.456787109 CET	50018	443	192.168.2.6	20.198.119.143
Dec 18, 2024 11:00:06.456820965 CET	443	50018	20.198.119.143	192.168.2.6
Dec 18, 2024 11:00:08.674666882 CET	443	50018	20.198.119.143	192.168.2.6
Dec 18, 2024 11:00:08.674834013 CET	50018	443	192.168.2.6	20.198.119.143
Dec 18, 2024 11:00:08.676528931 CET	50018	443	192.168.2.6	20.198.119.143
Dec 18, 2024 11:00:08.676547050 CET	443	50018	20.198.119.143	192.168.2.6
Dec 18, 2024 11:00:08.676898003 CET	443	50018	20.198.119.143	192.168.2.6
Dec 18, 2024 11:00:08.679441929 CET	50018	443	192.168.2.6	20.198.119.143
Dec 18, 2024 11:00:08.679496050 CET	50018	443	192.168.2.6	20.198.119.143
Dec 18, 2024 11:00:08.679507971 CET	443	50018	20.198.119.143	192.168.2.6
Dec 18, 2024 11:00:08.679605961 CET	50018	443	192.168.2.6	20.198.119.143
Dec 18, 2024 11:00:08.723359108 CET	443	50018	20.198.119.143	192.168.2.6
Dec 18, 2024 11:00:09.340401888 CET	443	50018	20.198.119.143	192.168.2.6
Dec 18, 2024 11:00:09.340719938 CET	443	50018	20.198.119.143	192.168.2.6
Dec 18, 2024 11:00:09.340804100 CET	50018	443	192.168.2.6	20.198.119.143
Dec 18, 2024 11:00:09.342127085 CET	50018	443	192.168.2.6	20.198.119.143
Dec 18, 2024 11:00:09.342154980 CET	443	50018	20.198.119.143	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 10:58:19.299351931 CET	63684	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:19.299747944 CET	50712	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:19.437125921 CET	53	50712	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:22.795954943 CET	49457	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:22.796092987 CET	56235	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:23.338689089 CET	54972	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:23.338962078 CET	53431	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:23.476473093 CET	53	54972	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:23.477560997 CET	53	53431	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:24.106419086 CET	54357	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:24.107206106 CET	65181	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:24.107992887 CET	63356	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:24.108617067 CET	57542	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:24.243637085 CET	53	54357	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:24.244044065 CET	53	65181	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:24.244731903 CET	53	63356	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:24.245476007 CET	53	57542	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:24.262237072 CET	64818	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:24.262381077 CET	65183	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:24.399192095 CET	53	65183	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:24.400579929 CET	53	64818	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:28.969794989 CET	53	53062	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:28.989778996 CET	53	54529	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:30.811690092 CET	59829	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:30.811897039 CET	60096	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:30.949418068 CET	53	59829	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:30.949769020 CET	53	60096	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:31.715699911 CET	53	59217	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:34.293174028 CET	53	64492	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:34.850258112 CET	53	54138	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:38.027880907 CET	57675	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:38.028126001 CET	55974	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:38.160891056 CET	53	62254	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:38.164550066 CET	53	57675	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:38.167341948 CET	53	55974	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:38.185787916 CET	62246	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:38.323529959 CET	53	62246	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:39.074836969 CET	59335	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:39.074904919 CET	53304	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:39.211596012 CET	53	53304	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:39.211615086 CET	53	59335	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:40.646002054 CET	63932	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:40.789275885 CET	53	63932	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:49.254120111 CET	53	64779	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:50.178143978 CET	50967	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:50.501744986 CET	53	50967	1.1.1.1	192.168.2.6
Dec 18, 2024 10:58:58.752881050 CET	52796	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:58:58.890145063 CET	53	52796	1.1.1.1	192.168.2.6
Dec 18, 2024 10:59:08.179141045 CET	53	50503	1.1.1.1	192.168.2.6
Dec 18, 2024 10:59:23.114265919 CET	64291	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:59:23.251338005 CET	53	64291	1.1.1.1	192.168.2.6
Dec 18, 2024 10:59:28.918757915 CET	53	50031	1.1.1.1	192.168.2.6
Dec 18, 2024 10:59:30.501323938 CET	53	63866	1.1.1.1	192.168.2.6
Dec 18, 2024 10:59:43.698380947 CET	56178	53	192.168.2.6	1.1.1.1
Dec 18, 2024 10:59:43.835145950 CET	53	56178	1.1.1.1	192.168.2.6
Dec 18, 2024 11:00:01.166452885 CET	53	63946	1.1.1.1	192.168.2.6
Dec 18, 2024 11:00:16.207973003 CET	62901	53	192.168.2.6	1.1.1.1
Dec 18, 2024 11:00:16.344881058 CET	53	62901	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 10:58:19.299351931 CET	192.168.2.6	1.1.1.1	0x2912	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:19.299747944 CET	192.168.2.6	1.1.1.1	0xea49	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Dec 18, 2024 10:58:22.795954943 CET	192.168.2.6	1.1.1.1	0x7fba	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:22.796092987 CET	192.168.2.6	1.1.1.1	0xdb76	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Dec 18, 2024 10:58:23.338689089 CET	192.168.2.6	1.1.1.1	0x7d7b	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:23.338962078 CET	192.168.2.6	1.1.1.1	0xbdaa	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Dec 18, 2024 10:58:24.106419086 CET	192.168.2.6	1.1.1.1	0x21fd	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:24.107206106 CET	192.168.2.6	1.1.1.1	0x1128	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 18, 2024 10:58:24.107992887 CET	192.168.2.6	1.1.1.1	0x7d57	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:24.108617067 CET	192.168.2.6	1.1.1.1	0x4208	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 18, 2024 10:58:24.262237072 CET	192.168.2.6	1.1.1.1	0xfa7f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:24.262381077 CET	192.168.2.6	1.1.1.1	0x82d0	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 18, 2024 10:58:30.811690092 CET	192.168.2.6	1.1.1.1	0x36b2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:30.811897039 CET	192.168.2.6	1.1.1.1	0x3af1	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 18, 2024 10:58:38.027880907 CET	192.168.2.6	1.1.1.1	0x73eb	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:38.028126001 CET	192.168.2.6	1.1.1.1	0x9426	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 18, 2024 10:58:38.185787916 CET	192.168.2.6	1.1.1.1	0x78da	Standard query (0)	api.gofile.io	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:39.074836969 CET	192.168.2.6	1.1.1.1	0x9d53	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:39.074904919 CET	192.168.2.6	1.1.1.1	0x698d	Standard query (0)	play.google.com	65	IN (0x0001)	false
Dec 18, 2024 10:58:40.646002054 CET	192.168.2.6	1.1.1.1	0xecf1	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:50.178143978 CET	192.168.2.6	1.1.1.1	0xde2	Standard query (0)	canstealer.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:58.752881050 CET	192.168.2.6	1.1.1.1	0x8a99	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:59:23.114265919 CET	192.168.2.6	1.1.1.1	0xc740	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:59:43.698380947 CET	192.168.2.6	1.1.1.1	0x5ed3	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:00:16.207973003 CET	192.168.2.6	1.1.1.1	0xd372	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 10:58:19.436620951 CET	1.1.1.1	192.168.2.6	0x2912	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 10:58:19.437125921 CET	1.1.1.1	192.168.2.6	0xea49	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 10:58:19.940888882 CET	1.1.1.1	192.168.2.6	0x87	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 10:58:19.940888882 CET	1.1.1.1	192.168.2.6	0x87	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:19.946399927 CET	1.1.1.1	192.168.2.6	0xeea	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 10:58:20.768212080 CET	1.1.1.1	192.168.2.6	0x1c6c	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 10:58:20.769478083 CET	1.1.1.1	192.168.2.6	0xe80f	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 10:58:20.769478083 CET	1.1.1.1	192.168.2.6	0xe80f	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:22.932979107 CET	1.1.1.1	192.168.2.6	0xdb76	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 10:58:23.026529074 CET	1.1.1.1	192.168.2.6	0x7fba	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 10:58:23.476473093 CET	1.1.1.1	192.168.2.6	0x7d7b	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 10:58:23.476473093 CET	1.1.1.1	192.168.2.6	0x7d7b	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:23.477560997 CET	1.1.1.1	192.168.2.6	0xbdaa	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 10:58:24.243637085 CET	1.1.1.1	192.168.2.6	0x21fd	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:24.243637085 CET	1.1.1.1	192.168.2.6	0x21fd	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:24.244044065 CET	1.1.1.1	192.168.2.6	0x1128	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 18, 2024 10:58:24.244731903 CET	1.1.1.1	192.168.2.6	0x7d57	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:24.244731903 CET	1.1.1.1	192.168.2.6	0x7d57	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:24.245476007 CET	1.1.1.1	192.168.2.6	0x4208	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 18, 2024 10:58:24.399192095 CET	1.1.1.1	192.168.2.6	0x82d0	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 18, 2024 10:58:24.400579929 CET	1.1.1.1	192.168.2.6	0xfa7f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:24.400579929 CET	1.1.1.1	192.168.2.6	0xfa7f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:30.949418068 CET	1.1.1.1	192.168.2.6	0x36b2	No error (0)	www.google.com		142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:30.949769020 CET	1.1.1.1	192.168.2.6	0x3af1	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 18, 2024 10:58:38.164550066 CET	1.1.1.1	192.168.2.6	0x73eb	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 10:58:38.164550066 CET	1.1.1.1	192.168.2.6	0x73eb	No error (0)	plus.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:38.167341948 CET	1.1.1.1	192.168.2.6	0x9426	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 10:58:38.323529959 CET	1.1.1.1	192.168.2.6	0x78da	No error (0)	api.gofile.io		45.112.123.126	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:39.211615086 CET	1.1.1.1	192.168.2.6	0x9d53	No error (0)	play.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:40.789275885 CET	1.1.1.1	192.168.2.6	0xecf1	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:50.501744986 CET	1.1.1.1	192.168.2.6	0xde2	No error (0)	canstealer.com		104.21.76.84	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:50.501744986 CET	1.1.1.1	192.168.2.6	0xde2	No error (0)	canstealer.com		172.67.191.110	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:58.890145063 CET	1.1.1.1	192.168.2.6	0x8a99	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:58.890145063 CET	1.1.1.1	192.168.2.6	0x8a99	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:58.890145063 CET	1.1.1.1	192.168.2.6	0x8a99	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:58:58.890145063 CET	1.1.1.1	192.168.2.6	0x8a99	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:59:23.251338005 CET	1.1.1.1	192.168.2.6	0xc740	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:59:23.251338005 CET	1.1.1.1	192.168.2.6	0xc740	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:59:23.251338005 CET	1.1.1.1	192.168.2.6	0xc740	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:59:23.251338005 CET	1.1.1.1	192.168.2.6	0xc740	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:59:43.835145950 CET	1.1.1.1	192.168.2.6	0x5ed3	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:59:43.835145950 CET	1.1.1.1	192.168.2.6	0x5ed3	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:59:43.835145950 CET	1.1.1.1	192.168.2.6	0x5ed3	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Dec 18, 2024 10:59:43.835145950 CET	1.1.1.1	192.168.2.6	0x5ed3	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:00:16.344881058 CET	1.1.1.1	192.168.2.6	0xd372	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:00:16.344881058 CET	1.1.1.1	192.168.2.6	0xd372	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:00:16.344881058 CET	1.1.1.1	192.168.2.6	0xd372	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:00:16.344881058 CET	1.1.1.1	192.168.2.6	0xd372	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

apis.google.com

play.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49707	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 09:58:16 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 77 54 50 61 4c 71 33 58 76 45 53 78 6e 4b 55 47 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 35 34 37 34 30 37 62 62 33 64 31 36 30 66 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: wTPaLq3XvESxnKUG.1Context: 8547407bb3d160ff
2024-12-18 09:58:16 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-18 09:58:16 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 77 54 50 61 4c 71 33 58 76 45 53 78 6e 4b 55 47 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 35 34 37 34 30 37 62 62 33 64 31 36 30 66 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 4c 35 72 65 4e 45 4c 48 77 54 6d 2b 42 31 4f 2b 6e 41 61 4e 75 35 49 74 5a 66 6f 4f 30 5a 68 46 7a 36 48 54 32 51 50 52 6b 5a 59 65 52 35 6e 41 66 6d 43 6f 46 62 34 36 46 50 49 72 73 76 30 64 5a 73 73 57 58 41 4b 76 43 33 6c 49 62 4c 39 79 73 34 39 31 37 6d 51 5a 71 56 59 37 70 6e 32 41 48 39 51 70 70 37 61 7a 6a 78 52 51 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: wTPaLq3XvESxnKUG.2Context: 8547407bb3d160ff<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcL5reNELHwTm+B1O+nAaNu5ItZfoO0ZhFz6HT2QPRkZYeR5nAfmCoFb46FPIrsv0dZssWXAKvC3lIbL9ys4917mQZqVY7pn2AH9Qpp7azjxRQ
2024-12-18 09:58:16 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 77 54 50 61 4c 71 33 58 76 45 53 78 6e 4b 55 47 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 35 34 37 34 30 37 62 62 33 64 31 36 30 66 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: wTPaLq3XvESxnKUG.3Context: 8547407bb3d160ff<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-18 09:58:17 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-18 09:58:17 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 52 68 58 4a 44 7a 56 6d 76 55 47 51 33 4b 30 35 6a 63 64 45 45 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: RhXJDzVmvUGQ3K05jcdEEg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49746	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 09:58:28 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 64 49 6f 2b 6d 33 54 71 76 55 79 35 51 59 65 6c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 61 63 63 32 66 61 66 34 64 31 63 38 66 38 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: dIo+m3TqvUy5QYel.1Context: facc2faf4d1c8f84
2024-12-18 09:58:28 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-18 09:58:28 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 64 49 6f 2b 6d 33 54 71 76 55 79 35 51 59 65 6c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 61 63 63 32 66 61 66 34 64 31 63 38 66 38 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 4c 35 72 65 4e 45 4c 48 77 54 6d 2b 42 31 4f 2b 6e 41 61 4e 75 35 49 74 5a 66 6f 4f 30 5a 68 46 7a 36 48 54 32 51 50 52 6b 5a 59 65 52 35 6e 41 66 6d 43 6f 46 62 34 36 46 50 49 72 73 76 30 64 5a 73 73 57 58 41 4b 76 43 33 6c 49 62 4c 39 79 73 34 39 31 37 6d 51 5a 71 56 59 37 70 6e 32 41 48 39 51 70 70 37 61 7a 6a 78 52 51 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: dIo+m3TqvUy5QYel.2Context: facc2faf4d1c8f84<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcL5reNELHwTm+B1O+nAaNu5ItZfoO0ZhFz6HT2QPRkZYeR5nAfmCoFb46FPIrsv0dZssWXAKvC3lIbL9ys4917mQZqVY7pn2AH9Qpp7azjxRQ
2024-12-18 09:58:28 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 64 49 6f 2b 6d 33 54 71 76 55 79 35 51 59 65 6c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 61 63 63 32 66 61 66 34 64 31 63 38 66 38 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: dIo+m3TqvUy5QYel.3Context: facc2faf4d1c8f84<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-18 09:58:29 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-18 09:58:29 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 7a 43 7a 4b 2f 59 6b 6d 4e 55 53 38 36 46 69 5a 50 39 4d 6e 61 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: zCzK/YkmNUS86FiZP9Mnaw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49763	142.250.181.132	443	672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 09:58:32 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 09:58:33 UTC	1219	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 09:58:33 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-jRoqpQChssVHpDsObkfveQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/web Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/web"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-18 09:58:33 UTC	171	IN	Data Raw: 61 35 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 5d 2c 5b 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 65 76 65 6e 74 69 64 22 3a 35 37 37 30 39 37 33 32 32 30 37 36 32 34 38 39 37 32 36 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 5d 2c 22 67 6f 6f 67 6c 65 3a 76 65 72 62 61 74 69 6d 72 65 6c 65 76 61 6e 63 65 22 3a 38 35 31 7d 5d 0d 0a Data Ascii: a5)]}'["",[],[],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggesteventid":5770973220762489726,"google:suggesttype":[],"google:verbatimrelevance":851}]
2024-12-18 09:58:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49769	142.250.181.132	443	672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 09:58:33 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 09:58:33 UTC	973	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 18 Dec 2024 09:58:33 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-18 09:58:33 UTC	417	IN	Data Raw: 31 36 65 61 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 16ea)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-18 09:58:33 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 33 20 31 38 68 31 38 76 2d 32 48 33 76 32 7a 6d 30 2d 35 68 31 38 76 2d 32 48 33 76 32 7a 6d 30 2d 37 76 32 68 31 38 Data Ascii: ss\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18
2024-12-18 09:58:33 UTC	1390	IN	Data Raw: 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 41 64 20 67 62 5f 6c 64 20 67 62 5f 4b 65 20 67 62 5f 46 65 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 Data Ascii: e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_Ad gb_ld gb_Ke gb_Fe\"\u003e\u003c
2024-12-18 09:58:33 UTC	1390	IN	Data Raw: 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 38 2e 35 2d 32 31 2e 35 54 33 35 30 2d 38 34 30 68 32 36 30 71 31 33 20 30 20 32 31 2e 35 20 38 2e 35 54 36 34 30 2d 38 31 30 71 30 20 Data Ascii: ght\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13 8.5-21.5T350-840h260q13 0 21.5 8.5T640-810q0
2024-12-18 09:58:33 UTC	1287	IN	Data Raw: 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 5c 22 5c 75 30 30 Data Ascii: ,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2z\"\u00
2024-12-18 09:58:33 UTC	303	IN	Data Raw: 31 32 38 0d 0a 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 35 33 2c 33 37 30 31 33 38 34 2c 31 30 32 32 37 38 32 30 35 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 Data Ascii: 128","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700253,3701384,102278205],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapp
2024-12-18 09:58:34 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 3b 5c 6e 74 72 79 7b 5c 6e 5f 2e 78 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 61 2e 6a 29 69 66 28 63 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 66 6f 72 28 76 61 72 20 64 20 6f 66 20 63 29 5f 2e 78 64 28 61 2c 62 2c 64 29 3b 65 6c 73 65 7b 64 5c 75 30 30 33 64 28 30 2c 5f 2e 7a 29 28 61 2e 43 2c 61 2c 62 29 3b 63 6f 6e 73 74 20 65 5c 75 30 30 33 64 61 2e 76 2b 63 3b 61 2e 76 2b 2b 3b 62 2e 64 61 74 61 73 65 74 2e 65 71 69 64 5c 75 30 30 33 64 65 3b 61 2e 42 5b 65 5d 5c 75 30 30 33 64 64 3b 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 62 2e 61 64 64 45 Data Ascii: 8000ction(_){var window\u003dthis;\ntry{\n_.xd\u003dfunction(a,b,c){if(!a.j)if(c instanceof Array)for(var d of c)_.xd(a,b,d);else{d\u003d(0,_.z)(a.C,a,b);const e\u003da.v+c;a.v++;b.dataset.eqid\u003de;a.B[e]\u003dd;b\u0026\u0026b.addEventListener?b.addE
2024-12-18 09:58:34 UTC	1390	IN	Data Raw: 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 49 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 46 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6e 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 4b 64 5c 75 30 30 33 64 5b 47 64 28 5c 22 64 61 74 61 5c 22 29 2c 47 64 28 5c 22 68 74 74 70 5c 22 29 2c 47 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 47 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 47 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 46 64 28 61 5c 75 30 30 33 64 5c 75 30 Data Ascii: class{constructor(a){this.i\u003da}toString(){return this.i}};_.Jd\u003dnew _.Id(\"about:invalid#zClosurez\");_.Fd\u003dclass{constructor(a){this.nh\u003da}};_.Kd\u003d[Gd(\"data\"),Gd(\"http\"),Gd(\"https\"),Gd(\"mailto\"),Gd(\"ftp\"),new _.Fd(a\u003d\u0
2024-12-18 09:58:34 UTC	1390	IN	Data Raw: 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 4d 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 Data Ascii: t){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.$d\u003dfunction(a){var b\u003d_.Ma(a);return b\u003
2024-12-18 09:58:34 UTC	1390	IN	Data Raw: 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6a 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6a 65 5b 64 5d 2c 63 29 3a 5f 2e 65 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 65 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6a 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 Data Ascii: xt\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:je.hasOwnProperty(d)?a.setAttribute(je[d],c):_.ee(d,\"aria-\")\|\|_.ee(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};je\u003d{cellpadding:\"cellPadding\",cellspacing

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49768	142.250.181.132	443	672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 09:58:33 UTC	361	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 09:58:33 UTC	933	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 18 Dec 2024 09:58:33 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-18 09:58:33 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-18 09:58:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49795	142.250.181.46	443	672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 09:58:39 UTC	721	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.ZpMpph_5a4M.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo_c5__TAiALeuHoQOKG0BnSpdbJrQ/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 09:58:40 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117446 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 11 Dec 2024 22:22:46 GMT Expires: Thu, 11 Dec 2025 22:22:46 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 02 Dec 2024 19:15:50 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 560154 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-18 09:58:40 UTC	474	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 5d 29 3b 0a 76 61 72 20 63 61 2c 64 61 2c 68 61 2c 6d 61 2c 78 61 2c 41 61 2c 42 61 3b 63 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);var ca,da,ha,ma,xa,Aa,Ba;ca=function(a){var
2024-12-18 09:58:40 UTC	1390	IN	Data Raw: 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 72 72 6f 72 28 22 61 22 29 3b 7d 3b Data Ascii: alue;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};
2024-12-18 09:58:40 UTC	1390	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 3d 61 3b 72 65 74 75 72 6e 20 6e 65 77 20 62 7d 2c 71 61 3b 69 66 28 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 71 61 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3b 65 6c 73 65 7b 76 61 72 20 72 61 3b 61 3a 7b 76 61 72 20 73 61 3d 7b 61 3a 21 30 7d 2c 77 61 3d 7b 7d 3b 74 72 79 7b 77 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 73 61 3b 72 61 3d 77 61 2e 61 3b 62 72 65 61 6b 20 61 7d 63 61 74 63 68 28 61 29 7b 7d 72 61 3d 21 31 7d 71 61 3d 72 61 3f 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 62 3b 69 66 28 Data Ascii: function(a){var b=function(){};b.prototype=a;return new b},qa;if(typeof Object.setPrototypeOf=="function")qa=Object.setPrototypeOf;else{var ra;a:{var sa={a:!0},wa={};try{wa.__proto__=sa;ra=wa.a;break a}catch(a){}ra=!1}qa=ra?function(a,b){a.__proto__=b;if(
2024-12-18 09:58:40 UTC	1390	IN	Data Raw: 7b 66 6f 72 28 3b 74 68 69 73 2e 46 66 26 26 74 68 69 73 2e 46 66 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 68 3d 74 68 69 73 2e 46 66 3b 74 68 69 73 2e 46 66 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6b 3d 30 3b 6b 3c 68 2e 6c 65 6e 67 74 68 3b 2b 2b 6b 29 7b 76 61 72 20 6c 3d 68 5b 6b 5d 3b 68 5b 6b 5d 3d 6e 75 6c 6c 3b 74 72 79 7b 6c 28 29 7d 63 61 74 63 68 28 6d 29 7b 74 68 69 73 2e 6d 71 28 6d 29 7d 7d 7d 74 68 69 73 2e 46 66 3d 6e 75 6c 6c 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 71 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 7a 50 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 68 3b 0a 7d 29 7d 3b 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 45 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 Data Ascii: {for(;this.Ff&&this.Ff.length;){var h=this.Ff;this.Ff=[];for(var k=0;k<h.length;++k){var l=h[k];h[k]=null;try{l()}catch(m){this.mq(m)}}}this.Ff=null};b.prototype.mq=function(h){this.zP(function(){throw h;})};var e=function(h){this.Ea=0;this.wf=void 0;thi
2024-12-18 09:58:40 UTC	1390	IN	Data Raw: 68 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 7b 63 61 6e 63 65 6c 61 62 6c 65 3a 21 30 7d 29 3a 74 79 70 65 6f 66 20 6b 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 68 3d 6e 65 77 20 6b 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 7b 63 61 6e 63 65 6c 61 62 6c 65 3a 21 30 7d 29 3a 28 68 3d 5f 2e 6c 61 2e 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 43 75 73 74 6f 6d 45 76 65 6e 74 22 29 2c 68 2e 69 6e 69 74 43 75 73 74 6f 6d 45 76 65 6e 74 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 21 31 2c 21 30 2c 68 29 29 3b 68 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 Data Ascii: h("unhandledrejection",{cancelable:!0}):typeof k==="function"?h=new k("unhandledrejection",{cancelable:!0}):(h=_.la.document.createEvent("CustomEvent"),h.initCustomEvent("unhandledrejection",!1,!0,h));h.promise=this;h.reason=this.wf;return l(h)};e.prototy
2024-12-18 09:58:40 UTC	1390	IN	Data Raw: 64 6f 6e 65 29 7d 29 7d 3b 72 65 74 75 72 6e 20 65 7d 29 3b 76 61 72 20 43 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 54 68 65 20 27 74 68 69 73 27 20 76 61 6c 75 65 20 66 6f 72 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 6e 75 6c 6c 20 6f 72 20 75 6e 64 65 66 69 6e 65 64 22 29 3b 69 66 28 62 20 69 6e 73 74 61 6e 63 65 6f 66 20 52 65 67 45 78 70 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c Data Ascii: done)})};return e});var Ca=function(a,b,c){if(a==null)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegExp)throw new TypeError("First argument to String.prototype."+c+" must not be a regul
2024-12-18 09:58:40 UTC	1390	IN	Data Raw: 5f 68 69 64 64 65 6e 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b 65 28 22 70 72 65 76 65 6e 74 45 78 74 65 6e 73 69 6f 6e 73 22 29 3b 65 28 22 73 65 61 6c 22 29 3b 76 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 46 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 79 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 Data Ascii: _hidden_"+Math.random();e("freeze");e("preventExtensions");e("seal");var h=0,k=function(l){this.Fa=(h+=Math.random()+1).toString();if(l){l=_.ya(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw E
2024-12-18 09:58:40 UTC	1390	IN	Data Raw: 74 68 69 73 5b 31 5d 2e 53 6b 3d 6d 2e 5a 65 2c 74 68 69 73 2e 73 69 7a 65 2b 2b 29 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 6c 65 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 53 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 53 6b 3d 0a 6b 2e 5a 65 2e 53 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 Data Ascii: this[1].Sk=m.Ze,this.size++);return this};c.prototype.delete=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Sk.next=k.Ze.next,k.Ze.next.Sk=k.Ze.Sk,k.Ze.head=null,this.size--,!0):!1};c.protot
2024-12-18 09:58:40 UTC	1390	IN	Data Raw: 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 74 79 70 65 6f 66 20 61 21 3d 22 66 75 6e 63 74 69 6f 6e 22 7c 7c 21 61 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 79 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e Data Ascii: ction(){if(!a\|\|typeof a!="function"\|\|!a.prototype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ya([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.n
2024-12-18 09:58:40 UTC	1390	IN	Data Raw: 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 46 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 5b 62 2c 63 5d 7d 29 7d 7d 29 3b 0a 6d 61 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 6b 65 79 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 46 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 7d 29 7d 7d 29 3b 6d 61 28 22 67 6c 6f 62 61 6c 54 68 69 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7c 7c 5f 2e 6c 61 7d 29 3b 6d 61 28 22 53 Data Ascii: ray.prototype.entries",function(a){return a?a:function(){return Fa(this,function(b,c){return[b,c]})}});ma("Array.prototype.keys",function(a){return a?a:function(){return Fa(this,function(b){return b})}});ma("globalThis",function(a){return a\|\|_.la});ma("S

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49794	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 09:58:40 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 6e 75 6f 52 50 67 78 58 65 6b 4b 47 39 37 70 4d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 39 38 64 32 34 35 62 38 66 62 39 64 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: nuoRPgxXekKG97pM.1Context: 2998d245b8fb9da
2024-12-18 09:58:40 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-18 09:58:40 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 6e 75 6f 52 50 67 78 58 65 6b 4b 47 39 37 70 4d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 39 38 64 32 34 35 62 38 66 62 39 64 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 4c 35 72 65 4e 45 4c 48 77 54 6d 2b 42 31 4f 2b 6e 41 61 4e 75 35 49 74 5a 66 6f 4f 30 5a 68 46 7a 36 48 54 32 51 50 52 6b 5a 59 65 52 35 6e 41 66 6d 43 6f 46 62 34 36 46 50 49 72 73 76 30 64 5a 73 73 57 58 41 4b 76 43 33 6c 49 62 4c 39 79 73 34 39 31 37 6d 51 5a 71 56 59 37 70 6e 32 41 48 39 51 70 70 37 61 7a 6a 78 52 51 4b Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: nuoRPgxXekKG97pM.2Context: 2998d245b8fb9da<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcL5reNELHwTm+B1O+nAaNu5ItZfoO0ZhFz6HT2QPRkZYeR5nAfmCoFb46FPIrsv0dZssWXAKvC3lIbL9ys4917mQZqVY7pn2AH9Qpp7azjxRQK
2024-12-18 09:58:40 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 6e 75 6f 52 50 67 78 58 65 6b 4b 47 39 37 70 4d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 39 38 64 32 34 35 62 38 66 62 39 64 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: nuoRPgxXekKG97pM.3Context: 2998d245b8fb9da<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-18 09:58:40 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-18 09:58:40 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 39 6e 30 69 78 31 31 74 69 55 2b 6d 59 4f 4d 4e 47 4d 4a 2f 5a 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 9n0ix11tiU+mYOMNGMJ/Zw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49797	142.250.181.110	443	672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 09:58:40 UTC	714	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 905 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 09:58:40 UTC	905	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 34 35 31 35 39 31 37 31 36 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1734515917169",null,null,null,
2024-12-18 09:58:41 UTC	918	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=520=DysEIYPMtsrcxOHfl-HIE3RALebXZsTOe63cz015BE4croq04Hofl-8BdS1VTpaNjeJPvOQxmMy1D2irqtUxkbBrsZOYCfNU03rvYDv5g-x-q_6CtUT_ZcNFbBjDmGn9HfQT74xuNBRXjz465fPt-liG8PhXqOBOSqpDp0XSrfGlncM50cX_mXo; expires=Thu, 19-Jun-2025 09:58:41 GMT; path=/; domain=.google.com; HttpOnly P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 18 Dec 2024 09:58:41 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 18 Dec 2024 09:58:41 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-12-18 09:58:41 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-12-18 09:58:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49814	142.250.181.110	443	672	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 09:58:45 UTC	915	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 911 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=520=DysEIYPMtsrcxOHfl-HIE3RALebXZsTOe63cz015BE4croq04Hofl-8BdS1VTpaNjeJPvOQxmMy1D2irqtUxkbBrsZOYCfNU03rvYDv5g-x-q_6CtUT_ZcNFbBjDmGn9HfQT74xuNBRXjz465fPt-liG8PhXqOBOSqpDp0XSrfGlncM50cX_mXo
2024-12-18 09:58:45 UTC	911	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 34 35 31 35 39 32 32 34 30 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1734515922409",null,null,null,
2024-12-18 09:58:46 UTC	926	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=520=BlxFiJl_Tf78U0i2YSui4x-WO9YE-xsEI9uEX-ldZGyuW3hvktTykZi1865_H78FFMiypPjGLOaHcps9B2sGPfNPEFu3kxLb-NNBEH5Y0wVsBgPaoiaDUxTOGYgj3M79OFw8i86LeKx5IBdXCzURbqpi9PoQDuOPB0SnZ7uI0tukTPKi2SoGNEmeNzWrBGc; expires=Thu, 19-Jun-2025 09:58:46 GMT; path=/; domain=.google.com; HttpOnly P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 18 Dec 2024 09:58:46 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 18 Dec 2024 09:58:46 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2024-12-18 09:58:46 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-12-18 09:58:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49840	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 09:58:54 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 47 6a 67 44 62 6c 44 76 4d 30 75 6f 6f 47 75 5a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 38 34 31 36 39 35 35 31 30 30 64 36 34 37 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: GjgDblDvM0uooGuZ.1Context: 48416955100d6470
2024-12-18 09:58:54 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-18 09:58:54 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 47 6a 67 44 62 6c 44 76 4d 30 75 6f 6f 47 75 5a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 38 34 31 36 39 35 35 31 30 30 64 36 34 37 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 4c 35 72 65 4e 45 4c 48 77 54 6d 2b 42 31 4f 2b 6e 41 61 4e 75 35 49 74 5a 66 6f 4f 30 5a 68 46 7a 36 48 54 32 51 50 52 6b 5a 59 65 52 35 6e 41 66 6d 43 6f 46 62 34 36 46 50 49 72 73 76 30 64 5a 73 73 57 58 41 4b 76 43 33 6c 49 62 4c 39 79 73 34 39 31 37 6d 51 5a 71 56 59 37 70 6e 32 41 48 39 51 70 70 37 61 7a 6a 78 52 51 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: GjgDblDvM0uooGuZ.2Context: 48416955100d6470<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcL5reNELHwTm+B1O+nAaNu5ItZfoO0ZhFz6HT2QPRkZYeR5nAfmCoFb46FPIrsv0dZssWXAKvC3lIbL9ys4917mQZqVY7pn2AH9Qpp7azjxRQ
2024-12-18 09:58:54 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 47 6a 67 44 62 6c 44 76 4d 30 75 6f 6f 47 75 5a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 38 34 31 36 39 35 35 31 30 30 64 36 34 37 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: GjgDblDvM0uooGuZ.3Context: 48416955100d6470<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-18 09:58:55 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-18 09:58:55 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 66 61 72 75 7a 7a 76 6f 66 55 71 54 58 32 2b 73 64 53 45 36 41 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: faruzzvofUqTX2+sdSE6Aw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49892	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 09:59:14 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 32 47 58 59 38 4a 4f 36 62 30 79 41 2f 50 49 70 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 66 62 33 36 31 37 33 35 35 33 37 30 30 63 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 2GXY8JO6b0yA/PIp.1Context: 3fb36173553700ce
2024-12-18 09:59:14 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-18 09:59:14 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 32 47 58 59 38 4a 4f 36 62 30 79 41 2f 50 49 70 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 66 62 33 36 31 37 33 35 35 33 37 30 30 63 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 4c 35 72 65 4e 45 4c 48 77 54 6d 2b 42 31 4f 2b 6e 41 61 4e 75 35 49 74 5a 66 6f 4f 30 5a 68 46 7a 36 48 54 32 51 50 52 6b 5a 59 65 52 35 6e 41 66 6d 43 6f 46 62 34 36 46 50 49 72 73 76 30 64 5a 73 73 57 58 41 4b 76 43 33 6c 49 62 4c 39 79 73 34 39 31 37 6d 51 5a 71 56 59 37 70 6e 32 41 48 39 51 70 70 37 61 7a 6a 78 52 51 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 2GXY8JO6b0yA/PIp.2Context: 3fb36173553700ce<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcL5reNELHwTm+B1O+nAaNu5ItZfoO0ZhFz6HT2QPRkZYeR5nAfmCoFb46FPIrsv0dZssWXAKvC3lIbL9ys4917mQZqVY7pn2AH9Qpp7azjxRQ
2024-12-18 09:59:14 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 32 47 58 59 38 4a 4f 36 62 30 79 41 2f 50 49 70 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 66 62 33 36 31 37 33 35 35 33 37 30 30 63 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 2GXY8JO6b0yA/PIp.3Context: 3fb36173553700ce<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-18 09:59:14 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-18 09:59:14 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 65 6d 32 33 52 74 61 4a 4b 6b 57 4e 4c 59 35 6c 48 4c 37 4b 2b 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: em23RtaJKkWNLY5lHL7K+w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49955	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 09:59:40 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 54 47 78 36 77 37 72 79 72 6b 79 34 76 56 45 46 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 62 66 38 61 65 37 33 38 34 64 64 33 37 63 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: TGx6w7ryrky4vVEF.1Context: cbf8ae7384dd37c6
2024-12-18 09:59:40 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-18 09:59:40 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 54 47 78 36 77 37 72 79 72 6b 79 34 76 56 45 46 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 62 66 38 61 65 37 33 38 34 64 64 33 37 63 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 4c 35 72 65 4e 45 4c 48 77 54 6d 2b 42 31 4f 2b 6e 41 61 4e 75 35 49 74 5a 66 6f 4f 30 5a 68 46 7a 36 48 54 32 51 50 52 6b 5a 59 65 52 35 6e 41 66 6d 43 6f 46 62 34 36 46 50 49 72 73 76 30 64 5a 73 73 57 58 41 4b 76 43 33 6c 49 62 4c 39 79 73 34 39 31 37 6d 51 5a 71 56 59 37 70 6e 32 41 48 39 51 70 70 37 61 7a 6a 78 52 51 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: TGx6w7ryrky4vVEF.2Context: cbf8ae7384dd37c6<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcL5reNELHwTm+B1O+nAaNu5ItZfoO0ZhFz6HT2QPRkZYeR5nAfmCoFb46FPIrsv0dZssWXAKvC3lIbL9ys4917mQZqVY7pn2AH9Qpp7azjxRQ
2024-12-18 09:59:40 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 54 47 78 36 77 37 72 79 72 6b 79 34 76 56 45 46 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 62 66 38 61 65 37 33 38 34 64 64 33 37 63 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: TGx6w7ryrky4vVEF.3Context: cbf8ae7384dd37c6<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-18 09:59:41 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-18 09:59:41 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 5a 61 52 6f 6e 39 5a 54 4d 6b 57 7a 4c 4c 79 68 67 37 6e 76 51 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ZaRon9ZTMkWzLLyhg7nvQw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	50018	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 10:00:08 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6c 43 77 4e 36 38 71 62 70 6b 57 6f 59 67 67 66 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 35 66 38 66 37 39 36 62 64 36 31 66 37 39 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: lCwN68qbpkWoYggf.1Context: 25f8f796bd61f793
2024-12-18 10:00:08 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-18 10:00:08 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6c 43 77 4e 36 38 71 62 70 6b 57 6f 59 67 67 66 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 35 66 38 66 37 39 36 62 64 36 31 66 37 39 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 4c 35 72 65 4e 45 4c 48 77 54 6d 2b 42 31 4f 2b 6e 41 61 4e 75 35 49 74 5a 66 6f 4f 30 5a 68 46 7a 36 48 54 32 51 50 52 6b 5a 59 65 52 35 6e 41 66 6d 43 6f 46 62 34 36 46 50 49 72 73 76 30 64 5a 73 73 57 58 41 4b 76 43 33 6c 49 62 4c 39 79 73 34 39 31 37 6d 51 5a 71 56 59 37 70 6e 32 41 48 39 51 70 70 37 61 7a 6a 78 52 51 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: lCwN68qbpkWoYggf.2Context: 25f8f796bd61f793<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAcL5reNELHwTm+B1O+nAaNu5ItZfoO0ZhFz6HT2QPRkZYeR5nAfmCoFb46FPIrsv0dZssWXAKvC3lIbL9ys4917mQZqVY7pn2AH9Qpp7azjxRQ
2024-12-18 10:00:08 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6c 43 77 4e 36 38 71 62 70 6b 57 6f 59 67 67 66 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 35 66 38 66 37 39 36 62 64 36 31 66 37 39 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: lCwN68qbpkWoYggf.3Context: 25f8f796bd61f793<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-18 10:00:09 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-18 10:00:09 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 38 76 63 46 47 31 6f 6d 59 30 61 51 38 4b 2b 34 36 55 68 4f 57 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 8vcFG1omY0aQ8K+46UhOWw.0Payload parsing failed.

Target ID:	0
Start time:	04:58:13
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\urS3jQ9qb5.jar"" >> C:\cmdlinestart.log 2>&1
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:58:13
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:58:13
Start date:	18/12/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\urS3jQ9qb5.jar"
Imagebase:	0x360000
File size:	257'664 bytes
MD5 hash:	9DAA53BAB2ECB33DC0D9CA51552701FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CanStealer, Description: Yara detected Can Stealer, Source: 00000002.00000003.2435946154.00000000169E5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CanStealer, Description: Yara detected Can Stealer, Source: 00000002.00000002.2638926084.000000000AC06000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CanStealer, Description: Yara detected Can Stealer, Source: 00000002.00000002.2643684011.00000000169AC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CanStealer, Description: Yara detected Can Stealer, Source: 00000002.00000003.2435636231.0000000016987000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:58:15
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Imagebase:	0x810000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:58:15
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:58:15
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xf40000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:58:15
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:58:15
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe
Imagebase:	0x180000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:58:15
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:58:16
Start date:	18/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:58:16
Start date:	18/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=2220 --field-trial-handle=2200,i,14542655992206268435,5345874362756647771,262144 --disable-features=PaintHolding /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:58:16
Start date:	18/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --noerrdialogs --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:58:17
Start date:	18/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=2160 --field-trial-handle=2052,i,8316993096475149264,6081251299301412000,262144 --disable-features=PaintHolding /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:58:21
Start date:	18/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=6580 --field-trial-handle=2052,i,8316993096475149264,6081251299301412000,262144 --disable-features=PaintHolding /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:58:21
Start date:	18/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=6960 --field-trial-handle=2052,i,8316993096475149264,6081251299301412000,262144 --disable-features=PaintHolding /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:58:22
Start date:	18/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=7076 --field-trial-handle=2052,i,8316993096475149264,6081251299301412000,262144 --disable-features=PaintHolding /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	04:58:22
Start date:	18/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Microsoft\Edge\User Data" --mojo-platform-channel-handle=7076 --field-trial-handle=2052,i,8316993096475149264,6081251299301412000,262144 --disable-features=PaintHolding /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:58:23
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe
Imagebase:	0x180000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:58:23
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:58:24
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe
Imagebase:	0x180000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:58:24
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:58:24
Start date:	18/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\user\AppData\Local\Google\Chrome\User Data" --profile-directory=Default
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	04:58:27
Start date:	18/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Google\Chrome\User Data" --mojo-platform-channel-handle=2116 --field-trial-handle=2024,i,13611784778153370748,11681789006057499304,262144 --disable-features=PaintHolding /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	04:58:33
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe
Imagebase:	0x180000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	04:58:33
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	04:58:34
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\HOSTNAME.EXE
Wow64 process (32bit):	true
Commandline:	hostname
Imagebase:	0xc80000
File size:	11'776 bytes
MD5 hash:	B1C51FED46434CF91E65C7B605F8EF3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	04:58:34
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	04:58:34
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\HOSTNAME.EXE
Wow64 process (32bit):	true
Commandline:	hostname
Imagebase:	0xc80000
File size:	11'776 bytes
MD5 hash:	B1C51FED46434CF91E65C7B605F8EF3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	04:58:34
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	04:58:35
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\HOSTNAME.EXE
Wow64 process (32bit):	true
Commandline:	hostname
Imagebase:	0xc80000
File size:	11'776 bytes
MD5 hash:	B1C51FED46434CF91E65C7B605F8EF3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	04:58:35
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	04:58:35
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\HOSTNAME.EXE
Wow64 process (32bit):	true
Commandline:	hostname
Imagebase:	0xc80000
File size:	11'776 bytes
MD5 hash:	B1C51FED46434CF91E65C7B605F8EF3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	04:58:35
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	04:58:35
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\HOSTNAME.EXE
Wow64 process (32bit):	true
Commandline:	hostname
Imagebase:	0xc80000
File size:	11'776 bytes
MD5 hash:	B1C51FED46434CF91E65C7B605F8EF3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	04:58:35
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	04:58:36
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\HOSTNAME.EXE
Wow64 process (32bit):	true
Commandline:	hostname
Imagebase:	0xc80000
File size:	11'776 bytes
MD5 hash:	B1C51FED46434CF91E65C7B605F8EF3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	04:58:36
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	04:58:41
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\HOSTNAME.EXE
Wow64 process (32bit):	true
Commandline:	hostname
Imagebase:	0xc80000
File size:	11'776 bytes
MD5 hash:	B1C51FED46434CF91E65C7B605F8EF3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	04:58:41
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	04:58:41
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\HOSTNAME.EXE
Wow64 process (32bit):	true
Commandline:	hostname
Imagebase:	0xc80000
File size:	11'776 bytes
MD5 hash:	B1C51FED46434CF91E65C7B605F8EF3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	04:58:41
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	04:58:42
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\HOSTNAME.EXE
Wow64 process (32bit):	true
Commandline:	hostname
Imagebase:	0xc80000
File size:	11'776 bytes
MD5 hash:	B1C51FED46434CF91E65C7B605F8EF3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	04:58:42
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	04:58:42
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\HOSTNAME.EXE
Wow64 process (32bit):	true
Commandline:	hostname
Imagebase:	0xc80000
File size:	11'776 bytes
MD5 hash:	B1C51FED46434CF91E65C7B605F8EF3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	04:58:42
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	04:58:42
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\HOSTNAME.EXE
Wow64 process (32bit):	true
Commandline:	hostname
Imagebase:	0xc80000
File size:	11'776 bytes
MD5 hash:	B1C51FED46434CF91E65C7B605F8EF3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	04:58:42
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	04:58:42
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\HOSTNAME.EXE
Wow64 process (32bit):	true
Commandline:	hostname
Imagebase:	0xc80000
File size:	11'776 bytes
MD5 hash:	B1C51FED46434CF91E65C7B605F8EF3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	04:58:42
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	04:58:42
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\HOSTNAME.EXE
Wow64 process (32bit):	true
Commandline:	hostname
Imagebase:	0xc80000
File size:	11'776 bytes
MD5 hash:	B1C51FED46434CF91E65C7B605F8EF3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	04:58:42
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	04:58:42
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\HOSTNAME.EXE
Wow64 process (32bit):	true
Commandline:	hostname
Imagebase:	0xc80000
File size:	11'776 bytes
MD5 hash:	B1C51FED46434CF91E65C7B605F8EF3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	04:58:42
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	04:58:42
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\HOSTNAME.EXE
Wow64 process (32bit):	true
Commandline:	hostname
Imagebase:	0xc80000
File size:	11'776 bytes
MD5 hash:	B1C51FED46434CF91E65C7B605F8EF3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	04:58:43
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	04:58:43
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\HOSTNAME.EXE
Wow64 process (32bit):	true
Commandline:	hostname
Imagebase:	0x7ff7403e0000
File size:	11'776 bytes
MD5 hash:	B1C51FED46434CF91E65C7B605F8EF3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	04:58:43
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	04:58:43
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path win32_VideoController get name
Imagebase:	0xa90000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	04:58:43
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	04:58:44
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic cpu get name
Imagebase:	0xa90000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	04:58:44
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	04:58:46
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic os get Caption /value
Imagebase:	0xa90000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	04:58:46
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 18B085CF Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.2416486650.0000000018B08000.00000004.00000020.00020000.00000000.sdmp, Offset: 18B00000, based on PE: false

Associated: 00000002.00000003.2415941439.0000000018B00000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_18b00000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 520b294d2e83c288806f92579626c908f1b5997393482eb3fd43777287057810
Instruction ID: 632ee5f713e01b11e53025c9da7eca02547cc695706ff194a8ec24be1e750d8f
Opcode Fuzzy Hash: 520b294d2e83c288806f92579626c908f1b5997393482eb3fd43777287057810
Instruction Fuzzy Hash: AE91D81640D2D28FC7535BBC84B96E2BFF29D4FA2874E0AD8C9C05F033C156299AD791

Function 18B085CF Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.2416486650.0000000018B08000.00000004.00000020.00020000.00000000.sdmp, Offset: 18B08000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_18b00000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 520b294d2e83c288806f92579626c908f1b5997393482eb3fd43777287057810
Instruction ID: 632ee5f713e01b11e53025c9da7eca02547cc695706ff194a8ec24be1e750d8f
Opcode Fuzzy Hash: 520b294d2e83c288806f92579626c908f1b5997393482eb3fd43777287057810
Instruction Fuzzy Hash: AE91D81640D2D28FC7535BBC84B96E2BFF29D4FA2874E0AD8C9C05F033C156299AD791

Function 18B0A749 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.2416486650.0000000018B08000.00000004.00000020.00020000.00000000.sdmp, Offset: 18B00000, based on PE: false

Associated: 00000002.00000003.2415941439.0000000018B00000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_18b00000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0f7b9d79499f8b22005a6582369e0ec425111594024e5ef9d8deb68526f7ee2
Instruction ID: bfc86fb9ee34e0e378546045b8afc1aeeb71b1fe4f81d79aa60e5fbfe3a4a01a
Opcode Fuzzy Hash: f0f7b9d79499f8b22005a6582369e0ec425111594024e5ef9d8deb68526f7ee2
Instruction Fuzzy Hash: A051205690E3C14FDB938F7C54E52E2BFB29D6B62474E5AC8C8C01F423D0499A9BE385

Function 18B0A749 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.2416486650.0000000018B08000.00000004.00000020.00020000.00000000.sdmp, Offset: 18B08000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_18b00000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0f7b9d79499f8b22005a6582369e0ec425111594024e5ef9d8deb68526f7ee2
Instruction ID: bfc86fb9ee34e0e378546045b8afc1aeeb71b1fe4f81d79aa60e5fbfe3a4a01a
Opcode Fuzzy Hash: f0f7b9d79499f8b22005a6582369e0ec425111594024e5ef9d8deb68526f7ee2
Instruction Fuzzy Hash: A051205690E3C14FDB938F7C54E52E2BFB29D6B62474E5AC8C8C01F423D0499A9BE385

Function 18B1070D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.2416486650.0000000018B08000.00000004.00000020.00020000.00000000.sdmp, Offset: 18B08000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_18b00000_java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e003c785769be86dc1453f97534381e37c4aac572a3422ebe9de3f6e869fea6b
Instruction ID: 08e9f1b927e8a7b23ccc2b172e1add8838c54008297b0a9c07f717a472fbf021
Opcode Fuzzy Hash: e003c785769be86dc1453f97534381e37c4aac572a3422ebe9de3f6e869fea6b
Instruction Fuzzy Hash: 2521C51A50E2C25ECB138F7C94A92E2FFB59D6B62070D1DC8C8D01F013E525A69AC7D2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Process: Process Creation, Service: Service Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report urS3jQ9qb5.jar

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Oracle\Java\.oracle_jre_usage\b5820291038aa69c.timestamp

C:\Users\user\AppData\Local\Microsoft\724536.zip

C:\Users\user\AppData\Local\Microsoft\724536\Browsers\Microsoft Edge\cookie.txt (copy)

C:\Users\user\AppData\Local\Microsoft\724536\Game\craftrise.txt

C:\Users\user\AppData\Local\Microsoft\724536\Game\sonoyuncu.txt

C:\Users\user\AppData\Local\Microsoft\724536\screenshot.png

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0dd1aa5d-ef03-411c-bd50-c643a5d48d7f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\89618a08-e929-45ed-a3f0-2e3da3e4a9c1.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67629CB8-FF4.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3a194add-b9e0-4cfa-b0c9-3d7108ebeb7c.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Windows Analysis Report
urS3jQ9qb5.jar

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre